CVE-2021-44040: HTTP request line fuzzing attacks
First published: Wed Mar 23 2022(Updated: )
Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/trafficserver | 8.0.2+ds-1+deb10u6 8.1.7-0+deb10u2 8.1.7+ds-1~deb11u1 9.2.0+ds-2+deb12u1 9.2.2+ds-1 | |
| Apache Traffic Server | >=8.0.0<=8.1.3 | |
| Apache Traffic Server | >=9.0.0<=9.1.1 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6
- https://github.com/apache/trafficserver/commit/85c319a7f7c0537bee408ea25df6f1a5ed0a4071
- https://github.com/apache/trafficserver/commit/c4e6661a5a205b1f60279f0e66aa496023185967
- https://github.com/apache/trafficserver/commit/8c6f2ed84ba0d8e6255baceb99ee891ebe1ce473
- https://security-tracker.debian.org/tracker/CVE-2021-44040
- https://www.debian.org/security/2022/dsa-5153
Frequently Asked Questions
What is CVE-2021-44040?
CVE-2021-44040 is an Improper Input Validation vulnerability in request line parsing of Apache Traffic Server.
How does CVE-2021-44040 affect Apache Traffic Server?
CVE-2021-44040 allows an attacker to send invalid requests to Apache Traffic Server.
Which versions of Apache Traffic Server are affected by CVE-2021-44040?
CVE-2021-44040 affects Apache Traffic Server versions 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.
How severe is CVE-2021-44040?
CVE-2021-44040 has a severity rating of 7.5 (high).
How can I fix CVE-2021-44040?
To fix CVE-2021-44040, update to the recommended versions of Apache Traffic Server provided by Debian.
- collector/security-tracker-debian
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- package-manager/debian
- vendor/apache
- canonical/apache traffic server
- version/apache traffic server/8.0.0
- version/apache traffic server/8.1.3
- version/apache traffic server/9.0.0
- version/apache traffic server/9.1.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0