CVE-2021-42009: Apache Traffic Control Traffic Ops Email Injection Vulnerability
First published: Tue Oct 12 2021(Updated: )
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Traffic Control | >=4.1.0<5.1.3 | |
| >=4.1.0<5.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/10/12/1
- https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb@%3Cdev.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/re384fd0f44c6d230f31376153c6e8b59e4a669f927c1533d06d702af%40%3Cdev.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e3555597f31fc34f084e%40%3Ccommits.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb%40%3Cdev.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87%40%3Cannounce.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2021-42009?
CVE-2021-42009 is classified as a medium-severity vulnerability due to its potential for unauthorized access to email functionalities.
How do I fix CVE-2021-42009?
To remediate CVE-2021-42009, users should update Apache Traffic Control to version 5.1.3 or later.
Who is affected by CVE-2021-42009?
Users of Apache Traffic Control with Portal-level privileges are affected by CVE-2021-42009.
What type of attack does CVE-2021-42009 enable?
CVE-2021-42009 allows an attacker to send crafted emails through the Traffic Ops endpoint.
What versions of Apache Traffic Control are impacted by CVE-2021-42009?
CVE-2021-42009 affects Apache Traffic Control versions from 4.1.0 to 5.1.3.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/weakness
- agent/references
- agent/remedy
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/apache
- canonical/apache traffic control
- version/apache traffic control/4.1.0