PT-2015-3320 · Apache · Apache Traffic Server

Publicado 2015-07-01 · Atualizado 2017-09-21 · CVE-2015-5168

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 5.3.x through 5.3.1

Description The issue is related to the HTTP/2 experimental feature in Apache Traffic Server. It is caused by incorrect handling of HTTP/2 requests. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of data.

Recommendations For Apache Traffic Server versions 5.3.x through 5.3.1, update to version 5.3.2 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-02224

CVE-2015-5168

Produtos afetados

Apache Traffic Server

Referências · 12

• http://mail-archives.us.apache.org/mod_mbox/www-announce/201509.mbox/%3CCABF6JR2j5vesvnjbm6sDPB_zAGj3kNgzzHEpLUh6dWG6t8mC2w%40mail.gmail.com%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5168 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2015-5168 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5168 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5168 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5168 · Nota
• https://osv.dev/vulnerability/CVE-2015-5168 · Aviso do Fabricante
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201509.mbox/%3CCABF6JR2j5vesvnjbm6sDPB_zAGj3kNgzzHEpLUh6dWG6t8mC2wmail.gmail.com%3E · Nota
• https://bdu.fstec.ru/vul/2017-02224 · Nota de Segurança
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201509.mbox/[e-mail]%3E · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-5168 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-5168 · Aviso do Fabricante