PT-2015-3319 · Apache · Apache Traffic Server

Publicado

2015-07-01

·

Atualizado

2017-09-21

·

CVE-2015-5206

CVSS v2.0

10

Crítica

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions prior to 5.3.2
Description The issue is related to the HTTP/2 experimental feature in Apache Traffic Server, where an unspecified vulnerability exists due to incorrect handling of HTTP/2 requests. This could allow a remote attacker to impact the confidentiality, integrity, and availability of data.
Recommendations For versions prior to 5.3.2, update to version 5.3.2 or later to resolve the issue. As a temporary workaround, consider disabling the HTTP/2 experimental feature until a patch is available. Restrict access to the HTTP/2 module to minimize the risk of exploitation.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-02223
CVE-2015-5206

Produtos afetados

Apache Traffic Server