Improper input validation in Apache Traffic_server
CVE-2017-5660
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.020 (78.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.
Affected products
- Apache Traffic_server — versions 6.2.1, 6.2.2, 7.0.0
- Apache Software Foundation Traffic Server — versions 7.0.0 and prior, 6.2.0 and prior
- Debian Debian_linux — versions 9.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2017-5660?
- CVE-2017-5660 is a high-severity vulnerability in Apache Traffic_server, classified under Improper Input Validation. CVSS score: 8.6/10. Published 2018-02-27.
- How severe is CVE-2017-5660?
- High severity. CVSS v3 base score is 8.6 out of 10.