PT-2020-3646 · Apache · Apache Traffic Server

Zeddyu Lu · Published 2020-03-23 · Updated 2022-10-06 · CVE-2020-1944

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 6.0.0 through 6.2.3 Apache Traffic Server versions 7.0.0 through 7.1.8 Apache Traffic Server versions 8.0.0 through 8.0.5

Description The issue is related to inconsistent interpretation of HTTP requests, specifically with Transfer-Encoding and Content length headers in the context of a reverse proxy and proxy redirection. This can be exploited by a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service. The vulnerability involves a smuggling attack.

Recommendations For Apache Traffic Server versions 6.0.0 through 6.2.3, upgrade to version 7.1.9 or later. For Apache Traffic Server versions 7.0.0 through 7.1.8, upgrade to version 7.1.9 or later. For Apache Traffic Server versions 8.0.0 through 8.0.5, upgrade to version 8.0.6 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2020-03994

CVE-2020-1944

DSA-4672-1

Affected Products

Apache Traffic Server

References · 12

• https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4672-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1944 · Security Note
• https://bdu.fstec.ru/vul/2020-03994 · Security Note
• https://ubuntu.com/security/CVE-2020-1944 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1944 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1944 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1944 · Vendor Advisory
• https://debian.org/security/2020/dsa-4672 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-1944 · Vendor Advisory
• https://t.me/cvenotify/2058 · Telegram Post