PT-2021-3574 · Apache · Apache Traffic Server

Masaori Koshiba · Published 2021-06-24 · Updated 2021-09-20 · CVE-2021-35474

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 7.0.0 through 7.1.12 Apache Traffic Server versions 8.0.0 through 8.1.1 Apache Traffic Server versions 9.0.0 through 9.0.1

Description The issue is caused by a stack-based buffer overflow in the cachekey plugin of Apache Traffic Server. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Apache Traffic Server versions 7.0.0 through 7.1.12, update to a version outside of this range to resolve the issue. For Apache Traffic Server versions 8.0.0 through 8.1.1, update to a version outside of this range to resolve the issue. For Apache Traffic Server versions 9.0.0 through 9.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the cachekey plugin until a patch is available.

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

BDU:2021-03675

CVE-2021-35474

DSA-4957-1

Affected Products

Apache Traffic Server

References · 20

• https://osv.dev/vulnerability/DSA-4957-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-35474 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35474 · Vendor Advisory
• https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3E · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-35474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35474 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-35474 · Security Note
• https://debian.org/security/2021/dsa-4957 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35474 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-35474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03675 · Security Note
• https://github.com/apache/trafficserver/commit/5a9339d7bc65e1c2d8d2a0fc80bb051daf3cdb0b · Note
• https://github.com/apache/trafficserver/commit/b82a3d192f995fb9d78e1c44d51d9acca4783277 · Note
• https://github.com/apache/trafficserver/pull/7945 · Note
• https://t.me/cvenotify/16879 · Telegram Post