CVE-2021-37150: Protocol vs scheme mismatch
Published Aug 10, 2022
·Updated
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Affected Software
7 affected componentsFixes available
debian/trafficserver<=8.0.2+ds-1+deb10u6
8.1.7-0+deb10u28.1.7+ds-1~deb11u19.2.0+ds-2+deb12u19.2.2+ds-1
Apache Traffic Server>=8.0.0<=8.1.4
Apache Traffic Server>=9.0.0<=9.1.2
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Event History
Aug 10, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-37150?
CVE-2021-37150 has a severity rating of medium due to its potential to exploit improper input validation in Apache Traffic Server.
2
How do I fix CVE-2021-37150?
To fix CVE-2021-37150, upgrade to Apache Traffic Server version 8.1.7 or 9.2.0 and later.
3
Which versions of Apache Traffic Server are affected by CVE-2021-37150?
CVE-2021-37150 affects Apache Traffic Server versions between 8.0.0 and 9.1.2 inclusive.
4
Can CVE-2021-37150 be found in Debian packages?
Yes, CVE-2021-37150 can be found in Debian packages of Apache Traffic Server prior to version 8.1.7.
5
What operating systems are affected by CVE-2021-37150?
CVE-2021-37150 affects Debian Linux versions 10.0 and 11.0, as well as Fedora 35 and 36.