PT-2020-3648 · Apache · Apache Traffic Server

Published 2020-03-23 · Updated 2022-10-06 · CVE-2019-17559

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 6.0.0 through 6.2.3 Apache Traffic Server versions 7.0.0 through 7.1.8 Apache Traffic Server versions 8.0.0 through 8.0.5

Description The issue is related to inconsistent interpretation of HTTP requests, which can be exploited by a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service. It involves a smuggling attack and scheme parsing.

Recommendations For versions 6.0.0 through 6.2.3, upgrade to version 7.1.9 or later. For versions 7.0.0 through 7.1.8, upgrade to version 7.1.9 or later. For versions 8.0.0 through 8.0.5, upgrade to version 8.0.6 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2020-03996

CVE-2019-17559

DSA-4672-1

Affected Products

Apache Traffic Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2019-17559 · Security Note
• https://bdu.fstec.ru/vul/2020-03996 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17559 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17559 · Vendor Advisory
• https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17559 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4672-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17559 · Vendor Advisory
• https://debian.org/security/2020/dsa-4672 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17559 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17559 · Security Note
• https://t.me/cvenotify/2054 · Telegram Post