PT-2020-3647 · Apache · Apache Traffic Server

Published 2020-03-23 · Updated 2022-10-06 · CVE-2019-17565

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 6.0.0 through 6.2.3 Apache Traffic Server versions 7.0.0 through 7.1.8 Apache Traffic Server versions 8.0.0 through 8.0.5

Description The issue is related to a smuggling attack and chunked encoding, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service due to inconsistent interpretation of HTTP requests.

Recommendations For Apache Traffic Server versions 6.0.0 through 6.2.3, upgrade to version 7.1.9 or later. For Apache Traffic Server versions 7.0.0 through 7.1.8, upgrade to version 7.1.9 or later. For Apache Traffic Server versions 8.0.0 through 8.0.5, upgrade to version 8.0.6 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2020-03995

CVE-2019-17565

DSA-4672-1

Affected Products

Apache Traffic Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2019-17565 · Security Note
• https://bdu.fstec.ru/vul/2020-03995 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17565 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17565 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17565 · Vendor Advisory
• https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17565 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17565 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4672-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17565 · Vendor Advisory
• https://debian.org/security/2020/dsa-4672 · Vendor Advisory
• https://t.me/cvenotify/2055 · Telegram Post