PT-2019-4792 · Apache · Apache Traffic Server

Publicado 2019-09-09 · Atualizado 2022-01-01 · CVE-2019-10079

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions prior to 7.1.7 Apache Traffic Server versions prior to 8.0.4

Description The issue arises from incorrect handling of HTTP/2 requests, allowing a remote attacker to impact data confidentiality, integrity, and availability. Earlier versions of Apache Traffic Server did not limit the number of setting frames sent from the client using the HTTP/2 protocol, making them susceptible to HTTP/2 setting flood attacks.

Recommendations For versions prior to 7.1.7, upgrade to Apache Traffic Server 7.1.7 or later. For versions prior to 8.0.4, upgrade to Apache Traffic Server 8.0.4 or later.

Correção

RCE

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-20

CWE-770

Identificadores relacionados

BDU:2020-01370

CVE-2019-10079

DSA-4520-1

Produtos afetados

Apache Traffic Server

Referências · 30

• https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2019-10079 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10079 · Nota de Segurança
• https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E · Nota
• https://bdu.fstec.ru/vul/2019-02957 · Nota de Segurança
• https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9518 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/trafficserver · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10079 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-10079 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-4520-1 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10079 · Nota
• https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E · Nota
• https://bdu.fstec.ru/vul/2019-03646 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10079 · Nota de Segurança