CVE-2020-17522
First published: Tue Jan 26 2021(Updated: )
When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Traffic Control | >=3.0.0<=3.1.0 | |
| Apache Traffic Control | >=4.0.0<=4.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8@%3Ccommits.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/r3de212a3da73bcf98fa2db7eafb75b2eb8e131ff466e6efc4284df09%40%3Cdev.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/rc8bfd7d4f71d61e9193efcd4699eccbab3c202ec1d75ed9d502f08bf@%3Ccommits.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8%40%3Ccommits.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/rc8bfd7d4f71d61e9193efcd4699eccbab3c202ec1d75ed9d502f08bf%40%3Ccommits.trafficcontrol.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2020-17522?
CVE-2020-17522 has been classified as a moderate severity vulnerability due to its potential impact on CDN cache security.
How do I fix CVE-2020-17522?
To mitigate CVE-2020-17522, it's recommended to update Apache Traffic Control to a version beyond 4.1.0 to close the vulnerability.
What are the affected versions of Apache Traffic Control for CVE-2020-17522?
CVE-2020-17522 affects Apache Traffic Control versions 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0.
What kind of access does CVE-2020-17522 allow to attackers?
CVE-2020-17522 allows attackers to push arbitrary content into and remove arbitrary content from CDN cache servers.
Is CVE-2020-17522 present in earlier versions of Apache Traffic Control?
CVE-2020-17522 only applies to Apache Traffic Control versions starting from 3.0.0 onwards, thus earlier versions are not affected.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- vendor/apache
- canonical/apache traffic control
- version/apache traffic control/3.0.0
- version/apache traffic control/3.1.0
- version/apache traffic control/4.0.0
- version/apache traffic control/4.1.0