PT-2021-21530 · Apache · Apache Traffic Server

Published 2021-11-03 · Updated 2024-06-10 · CVE-2021-37147

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.2 Apache Traffic Server versions 9.0.0 through 9.1.0

Description The issue is related to improper input validation in the header parsing of Apache Traffic Server, allowing an attacker to smuggle requests.

Recommendations For versions 8.0.0 through 8.1.2, update to a version outside of this range to resolve the issue. For versions 9.0.0 through 9.1.0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the header parsing functionality until a patch is available.

Fix

HTTP Request/Response Smuggling

RCE

Weakness Enumeration

CWE-444

CWE-20

Related Identifiers

CVE-2021-37147

DSA-5153-1

OESA-2021-1437

Affected Products

Apache Traffic Server

References · 21

• https://ubuntu.com/security/CVE-2021-37147 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5153-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37147 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43082 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37149 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37147 · Vendor Advisory
• https://debian.org/security/2022/dsa-5153 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1437 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-37147 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-37147 · Vendor Advisory
• https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-37147 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41585 · Security Note
• https://github.com/apache/trafficserver/commit/64f25678bfbbd1433cce703e3c43bcc49a53de56 · Note