CVE-2021-32567: Reading HTTP/2 frames too many times
Published Jun 30, 2021
·Updated
Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.
Affected Software
5 affected componentsFixes available
debian/trafficserver
8.0.2+ds-1+deb10u68.1.7-0+deb10u28.1.7+ds-1~deb11u19.2.0+ds-2+deb12u19.2.2+ds-1
Apache Traffic Server>=7.0.0<=7.1.12
Apache Traffic Server>=8.0.0<=8.1.1
Apache Traffic Server>=9.0.0<=9.0.1
Debian Debian Linux=10.0
Event History
Jun 30, 2021
CVE Published
via MITRE·07:15 AM
Data Sourced
via MITRE·07:15 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-32567.
2
What is the severity level of CVE-2021-32567?
CVE-2021-32567 has a severity level of 7.5 (high).
3
How does CVE-2021-32567 affect Apache Traffic Server?
CVE-2021-32567 affects Apache Traffic Server versions 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, and 9.0.0 to 9.0.1.
4
What is the impact of CVE-2021-32567?
CVE-2021-32567 allows an attacker to perform a Denial-of-Service (DoS) attack on the server.
5
How can I fix CVE-2021-32567 on Debian-based systems?
To fix CVE-2021-32567 on Debian-based systems, update the 'trafficserver' package to version 8.0.2+ds-1+deb10u6, 8.1.7-0+deb10u2, 8.1.7+ds-1~deb11u1, 9.2.0+ds-2+deb12u1, or 9.2.2+ds-1.