CVE-2017-7671: Input Validation
First published: Tue Feb 27 2018(Updated: )
There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/trafficserver | 8.0.2+ds-1+deb10u6 8.1.7-0+deb10u2 8.1.7+ds-1~deb11u1 9.2.0+ds-2+deb12u1 9.2.2+ds-1 | |
| Apache Traffic Server | >=5.2.0<=5.3.2 | |
| Apache Traffic Server | >6.0.0<=6.2.0 | |
| Apache Traffic Server | =7.0.0 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/trafficserver/pull/1941
- https://security-tracker.debian.org/tracker/CVE-2017-7671
- https://lists.apache.org/thread.html/203bdcf9bbb718f3dc6f7aaf3e2af632474d51fa9e7bfb7832729905@%3Cdev.trafficserver.apache.org%3E
- https://www.debian.org/security/2018/dsa-4128
- https://lists.apache.org/thread.html/203bdcf9bbb718f3dc6f7aaf3e2af632474d51fa9e7bfb7832729905%40%3Cdev.trafficserver.apache.org%3E
Frequently Asked Questions
What is CVE-2017-7671?
CVE-2017-7671 is a denial-of-service (DOS) attack vulnerability in Apache Traffic Server (ATS) versions 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake that can cause the server to coredump.
What is the severity of CVE-2017-7671?
The severity of CVE-2017-7671 is high with a severity value of 7.5.
How does CVE-2017-7671 affect Apache Traffic Server?
CVE-2017-7671 affects Apache Traffic Server versions 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake by allowing a DOS attack that can cause the server to coredump.
What is the fix for CVE-2017-7671?
To fix CVE-2017-7671, upgrade to a version of Apache Traffic Server that is not affected. For example, version 8.0.2 or higher for Debian Linux.
Where can I find more information about CVE-2017-7671?
You can find more information about CVE-2017-7671 in the following references: [GitHub Pull Request](https://github.com/apache/trafficserver/pull/1941), [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2017-7671), [Apache Traffic Server Mailing List](https://lists.apache.org/thread.html/203bdcf9bbb718f3dc6f7aaf3e2af632474d51fa9e7bfb7832729905@%3Cdev.trafficserver.apache.org%3E).
- collector/security-tracker-debian
- collector/nvd-index
- agent/references
- agent/type
- agent/event
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/apache
- canonical/apache traffic server
- version/apache traffic server/5.2.0
- version/apache traffic server/5.3.2
- version/apache traffic server/6.2.0
- version/apache traffic server/7.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0