PT-2020-5796 · Apache · Apache Traffic Server

Bryan Call · Published 2020-08-12 · Updated 2021-01-15 · CVE-2020-17509

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 6.0.0 through 6.2.3 Apache Traffic Server versions 7.0.0 through 7.1.11 Apache Traffic Server versions 8.0.0 through 8.1.0

Description: The issue is related to the ATS negative cache option, which is vulnerable to a cache poisoning attack. This vulnerability can be exploited by a remote attacker to impact data integrity. The attack is associated with a flaw in the interpretation of HTTP requests.

Recommendations: For Apache Traffic Server versions 6.0.0 through 6.2.3, upgrade or disable the ATS negative cache option to mitigate the risk. For Apache Traffic Server versions 7.0.0 through 7.1.11, upgrade or disable the ATS negative cache option to mitigate the risk. For Apache Traffic Server versions 8.0.0 through 8.1.0, upgrade or disable the ATS negative cache option to mitigate the risk.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2021-01758

CVE-2020-17509

DSA-4805-1

Affected Products

Apache Traffic Server

References · 14

• https://cve.org/CVERecord?id=CVE-2020-17509 · Security Note
• https://lists.apache.org/thread.html/raa9f0589c26c4d146646425e51e2a33e1457492df9f7ea2019daa6d3%40%3Cannounce.trafficserver.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17509 · Security Note
• https://bdu.fstec.ru/vul/2021-01758 · Security Note
• https://ubuntu.com/security/CVE-2020-17509 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4805-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17509 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-17509 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-17509 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-17509 · Vendor Advisory
• https://github.com/apache/trafficserver/pull/7359 · Note
• https://t.me/cvenotify/8402 · Telegram Post
• https://t.me/cibsecurity/21895 · Telegram Post
• https://lists.apache.org/thread.html/raa9f0589c26c4d146646425e51e2a33e1457492df9f7ea2019daa6d3%40%3Cdev.trafficserver.apache.org%3E · Note