CVE-2017-5660: Input Validation
First published: Tue Feb 27 2018(Updated: )
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/trafficserver | 8.0.2+ds-1+deb10u6 8.1.7-0+deb10u2 8.1.7+ds-1~deb11u1 9.2.0+ds-2+deb12u1 9.2.2+ds-1 | |
| Apache Traffic Server | <=6.2.0 | |
| Apache Traffic Server | =6.2.1 | |
| Apache Traffic Server | =6.2.1-rc0 | |
| Apache Traffic Server | =6.2.2 | |
| Apache Traffic Server | =6.2.2-rc0 | |
| Apache Traffic Server | =7.0.0 | |
| Apache Traffic Server | =7.0.0-rc0 | |
| Apache Traffic Server | =7.0.0-rc1 | |
| Apache Traffic Server | =7.0.0-rc2 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/trafficserver/pull/1657
- https://issues.apache.org/jira/browse/TS-4930
- https://security-tracker.debian.org/tracker/CVE-2017-5660
- https://lists.apache.org/thread.html/22d84783d94c53a5132ec89f002fe5165c87561a9428bcb6713b3c98@%3Cdev.trafficserver.apache.org%3E
- https://www.debian.org/security/2018/dsa-4128
- https://lists.apache.org/thread.html/22d84783d94c53a5132ec89f002fe5165c87561a9428bcb6713b3c98%40%3Cdev.trafficserver.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2017-5660?
The severity of CVE-2017-5660 is rated as high with a score of 8.6.
How do I fix CVE-2017-5660?
To mitigate CVE-2017-5660, upgrade to Apache Traffic Server version 8.0.2+ds-1+deb10u6 or later.
What versions of Apache Traffic Server are affected by CVE-2017-5660?
CVE-2017-5660 affects Apache Traffic Server versions 6.2.0 and prior, as well as 7.0.0 and prior.
What type of vulnerability is CVE-2017-5660?
CVE-2017-5660 is categorized under CWE-20, which involves improper input validation.
Can CVE-2017-5660 impact upstream proxies?
Yes, CVE-2017-5660 may cause issues with upstream proxies leading to the wrong host being used.
- collector/security-tracker-debian
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/apache
- canonical/apache traffic server
- version/apache traffic server/6.2.0
- version/apache traffic server/6.2.1
- version/apache traffic server/6.2.1-rc0
- version/apache traffic server/6.2.2
- version/apache traffic server/6.2.2-rc0
- version/apache traffic server/7.0.0
- version/apache traffic server/7.0.0-rc0
- version/apache traffic server/7.0.0-rc1
- version/apache traffic server/7.0.0-rc2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0