CVE-2017-5660: Input Validation
Published Feb 27, 2018
·Updated
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
Affected Software
11 affected componentsFixes available
debian/trafficserver
8.0.2+ds-1+deb10u68.1.7-0+deb10u28.1.7+ds-1~deb11u19.2.0+ds-2+deb12u19.2.2+ds-1
Apache Traffic Server<=6.2.0
Apache Traffic Server=6.2.1
Apache Traffic Server=6.2.1-rc0
Apache Traffic Server=6.2.2
Apache Traffic Server=6.2.2-rc0
Apache Traffic Server=7.0.0
Apache Traffic Server=7.0.0-rc0
Apache Traffic Server=7.0.0-rc1
Apache Traffic Server=7.0.0-rc2
Debian Debian Linux=9.0
Event History
Feb 27, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-5660?
The severity of CVE-2017-5660 is rated as high with a score of 8.6.
2
How do I fix CVE-2017-5660?
To mitigate CVE-2017-5660, upgrade to Apache Traffic Server version 8.0.2+ds-1+deb10u6 or later.
3
What versions of Apache Traffic Server are affected by CVE-2017-5660?
CVE-2017-5660 affects Apache Traffic Server versions 6.2.0 and prior, as well as 7.0.0 and prior.
4
What type of vulnerability is CVE-2017-5660?
CVE-2017-5660 is categorized under CWE-20, which involves improper input validation.
5
Can CVE-2017-5660 impact upstream proxies?
Yes, CVE-2017-5660 may cause issues with upstream proxies leading to the wrong host being used.