CVE-2021-37150: Protocol vs scheme mismatch

Q: What is the severity of CVE-2021-37150?

CVE-2021-37150 has a severity rating of medium due to its potential to exploit improper input validation in Apache Traffic Server.

Q: How do I fix CVE-2021-37150?

To fix CVE-2021-37150, upgrade to Apache Traffic Server version 8.1.7 or 9.2.0 and later.

Q: Which versions of Apache Traffic Server are affected by CVE-2021-37150?

CVE-2021-37150 affects Apache Traffic Server versions between 8.0.0 and 9.1.2 inclusive.

Q: Can CVE-2021-37150 be found in Debian packages?

Yes, CVE-2021-37150 can be found in Debian packages of Apache Traffic Server prior to version 8.1.7.

Q: What operating systems are affected by CVE-2021-37150?

CVE-2021-37150 affects Debian Linux versions 10.0 and 11.0, as well as Fedora 35 and 36.

Published Aug 10, 2022

Updated

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Affected Software

7 affected componentsFixes available

Apache Traffic Server>=8.0.0<=8.1.4

Apache Traffic Server>=9.0.0<=9.1.2

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Fedoraproject Fedora=35

Fedoraproject Fedora=36

debian/trafficserver

9.2.5+ds-0+deb12u4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/trafficserver to a version that resolves this vulnerability.
Fixed in 9.2.5+ds-0+deb12u4

Event History

Aug 10, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5206

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3279-1

Frequently Asked Questions

What is the severity of CVE-2021-37150?