PT-2019-4792 · Apache · Apache Traffic Server

Published 2019-09-09 · Updated 2022-01-01 · CVE-2019-10079

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions prior to 7.1.7 Apache Traffic Server versions prior to 8.0.4

Description The issue arises from incorrect handling of HTTP/2 requests, allowing a remote attacker to impact data confidentiality, integrity, and availability. Earlier versions of Apache Traffic Server did not limit the number of setting frames sent from the client using the HTTP/2 protocol, making them susceptible to HTTP/2 setting flood attacks.

Recommendations For versions prior to 7.1.7, upgrade to Apache Traffic Server 7.1.7 or later. For versions prior to 8.0.4, upgrade to Apache Traffic Server 8.0.4 or later.

Fix

RCE

Allocation of Resources Without Limits

Weakness Enumeration

CWE-20

CWE-770

Related Identifiers

BDU:2020-01370

CVE-2019-10079

DSA-4520-1

Affected Products

Apache Traffic Server

References · 30

• https://osv.dev/vulnerability/CVE-2019-10079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10079 · Security Note
• https://bdu.fstec.ru/vul/2019-02957 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9518 · Security Note
• https://security-tracker.debian.org/tracker/source-package/trafficserver · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10079 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10079 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4520-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03646 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10079 · Security Note
• https://bdu.fstec.ru/vul/2019-02996 · Security Note
• https://osv.dev/vulnerability/DSA-4520-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01370 · Security Note
• https://bdu.fstec.ru/vul/2019-02995 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10079 · Vendor Advisory