Resource exhaustion in Apache Traffic Control
CVE-2017-7670
The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.048 (91.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Traffic_control — versions 1.8.1, 2.0.0
- Apache Software Foundation Traffic Control — versions 2.0.0 RC0 incubating, 1.8.0 incubating
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2017-7670?
- CVE-2017-7670 is a high-severity vulnerability in Apache Traffic Control, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2017-07-10.
- How severe is CVE-2017-7670?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2017-7670 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.