PT-2015-3320 · Apache · Apache Traffic Server

Published 2015-07-01 · Updated 2017-09-21 · CVE-2015-5168

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 5.3.x through 5.3.1

Description The issue is related to the HTTP/2 experimental feature in Apache Traffic Server. It is caused by incorrect handling of HTTP/2 requests. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of data.

Recommendations For Apache Traffic Server versions 5.3.x through 5.3.1, update to version 5.3.2 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-02224

CVE-2015-5168

Affected Products

Apache Traffic Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2015-5168 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5168 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5168 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5168 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-5168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02224 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-5168 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5168 · Vendor Advisory
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201509.mbox/%3CCABF6JR2j5vesvnjbm6sDPB_zAGj3kNgzzHEpLUh6dWG6t8mC2w%40mail.gmail.com%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5168 · Note
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201509.mbox/%3CCABF6JR2j5vesvnjbm6sDPB_zAGj3kNgzzHEpLUh6dWG6t8mC2wmail.gmail.com%3E · Note
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201509.mbox/[e-mail]%3E · Note