Search for packages
| purl | pkg:deb/ubuntu/trafficserver@3.2.4-1ubuntu1 |
| Next non-vulnerable version | 8.0.5+ds-3 |
| Latest non-vulnerable version | 8.0.5+ds-3 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2717-42n3-aaaf
Aliases: CVE-2017-5660 |
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used. |
Affected by 11 other vulnerabilities. |
|
VCID-3gua-vux5-aaaq
Aliases: CVE-2019-9512 GHSA-hgr8-6h9x-f7q9 |
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. |
Affected by 1 other vulnerability. |
|
VCID-55p6-wu6s-aaag
Aliases: CVE-2015-5206 |
Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168. |
Affected by 13 other vulnerabilities. |
|
VCID-5w83-fvxz-aaan
Aliases: CVE-2014-3525 |
Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks. |
Affected by 15 other vulnerabilities. |
|
VCID-68d9-yha7-aaad
Aliases: CVE-2015-5168 |
Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206. |
Affected by 13 other vulnerabilities. |
|
VCID-6ypc-78mx-aaac
Aliases: CVE-2019-9514 GHSA-39qc-96h7-956f |
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. |
Affected by 1 other vulnerability. |
|
VCID-78y4-tnbd-aaan
Aliases: CVE-2017-7671 |
There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump. |
Affected by 11 other vulnerabilities. |
|
VCID-dapa-wbjx-aaaj
Aliases: CVE-2018-8022 |
A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions. |
Affected by 10 other vulnerabilities. |
|
VCID-kfap-b6t7-aaam
Aliases: CVE-2019-9515 |
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. |
Affected by 1 other vulnerability. |
|
VCID-mzfp-e1uj-aaad
Aliases: CVE-2014-3624 |
Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT. |
Affected by 15 other vulnerabilities. |
|
VCID-p1tf-p7he-aaag
Aliases: CVE-2014-10022 |
Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to internal buffer sizing. |
Affected by 15 other vulnerabilities. |
|
VCID-q172-pxa4-aaan
Aliases: CVE-2018-8040 |
Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. |
Affected by 6 other vulnerabilities. |
|
VCID-q2kj-gzqu-aaap
Aliases: CVE-2018-8004 |
There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. |
Affected by 6 other vulnerabilities. |
|
VCID-syec-8mxh-aaar
Aliases: CVE-2019-10079 |
Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-tbrp-5sm7-aaak
Aliases: CVE-2019-9518 |
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU. |
Affected by 0 other vulnerabilities. |
|
VCID-u46t-6vjc-aaak
Aliases: CVE-2018-11783 |
sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1. |
Affected by 5 other vulnerabilities. |
|
VCID-wvrs-6k9g-aaaj
Aliases: CVE-2018-8005 |
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. |
Affected by 6 other vulnerabilities. |
|
VCID-z7wt-7vmh-aaan
Aliases: CVE-2018-1318 |
Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. |
Affected by 6 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|