PT-2022-12225 · Apache · Apache Traffic Server

Takuya Kitano · Published 2022-03-23 · Updated 2022-10-14 · CVE-2021-44759

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.0

Description The issue is related to an Improper Authentication vulnerability in the TLS origin validation of Apache Traffic Server, allowing an attacker to create a man-in-the-middle attack.

Recommendations For Apache Traffic Server versions 8.0.0 through 8.1.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-44759

DSA-5153-1

Affected Products

Apache Traffic Server

References · 11

• https://debian.org/security/2022/dsa-5153 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44759 · Security Note
• https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-44759 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44759 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5153-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44759 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44759 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44759 · Security Note
• https://t.me/cibsecurity/39409 · Telegram Post