PT-2020-5807 · Apache · Apache Traffic Server

Published 2020-08-12 · Updated 2021-07-21 · CVE-2020-17508

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 6.0.0 through 6.2.3 Apache Traffic Server versions 7.0.0 through 7.1.11 Apache Traffic Server versions 8.0.0 through 8.1.0

Description: The ATS ESI plugin has a memory disclosure issue, allowing a remote attacker to access confidential data. If you are running the plugin, an upgrade is recommended.

Recommendations: For Apache Traffic Server versions 6.0.0 through 6.2.3, upgrade to a version later than 6.2.3. For Apache Traffic Server versions 7.0.0 through 7.1.11, upgrade to version 7.1.12 or later. For Apache Traffic Server versions 8.0.0 through 8.1.0, upgrade to version 8.1.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2021-01773

CVE-2020-17508

DSA-4805-1

Affected Products

Apache Traffic Server

References · 14

• https://security-tracker.debian.org/tracker/CVE-2020-17508 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-17508 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-17508 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-17508 · Vendor Advisory
• https://lists.apache.org/thread.html/r65434f7acca3aebf81b0588587149c893fe9f8f9f159eaa7364a70ff%40%3Cannounce.trafficserver.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17508 · Security Note
• https://osv.dev/vulnerability/CVE-2020-17508 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01773 · Security Note
• https://ubuntu.com/security/CVE-2020-17508 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4805-1 · Vendor Advisory
• https://github.com/apache/trafficserver/pull/7358 · Note
• https://lists.apache.org/thread.html/r65434f7acca3aebf81b0588587149c893fe9f8f9f159eaa7364a70ff%40%3Cdev.trafficserver.apache.org%3E · Note
• https://t.me/cvenotify/8554 · Telegram Post
• https://t.me/cibsecurity/21898 · Telegram Post