CVE-2021-37150

EUVD-2021-23724
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADPADP
4.2 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
Affected Products (NVD)
VendorProductVersion
apachetraffic_server
8.0.0 ≤
𝑥
≤ 8.1.4
apachetraffic_server
9.0.0 ≤
𝑥
≤ 9.1.2
debiandebian_linux
10.0
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
trafficserver
bookworm
9.2.4+ds-0+deb12u1
fixed
bookworm (security)
9.2.5+ds-0+deb12u1
fixed
bullseye
8.1.10+ds-1~deb11u1
fixed
bullseye (security)
8.1.11+ds-0+deb11u1
fixed
sid
9.2.5+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
trafficserver
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
kinetic
ignored
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
ignored
xenial
needs-triage
Common Weakness Enumeration
References
https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21
https://lists.debian.org/debian-lts-announce/2023/01/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/
https://www.debian.org/security/2022/dsa-5206
https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21
https://lists.debian.org/debian-lts-announce/2023/01/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/
https://www.debian.org/security/2022/dsa-5206