CVE-2020-17509

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-17509
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-17509.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-17509
Related
Published
2021-01-11T10:15:13Z
Modified
2024-10-12T06:16:48.430712Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

References

Affected packages

Debian:11 / trafficserver

Package

Name
trafficserver
Purl
pkg:deb/debian/trafficserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.1.1+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / trafficserver

Package

Name
trafficserver
Purl
pkg:deb/debian/trafficserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.1.1+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/apache/trafficserver

Affected ranges

Type
GIT
Repo
https://github.com/apache/trafficserver
Events
Introduced
6c1c6cf20e7d0e287d697a0f4181436013d17c30
Last affected
439a7cfcb70dcb92485dd6989af80d9f900d1f99
Introduced
b310e3566f58dd04ec2b15b111ec86ea70e20019
Last affected
ac05db1ca58e990e0d2c49b57e5b6364df71dabc
Introduced
27f8e2cda9133864e6ffae0224c799fde5f10290
Last affected
eaed59510bda6f1d27854d9d3f07aace2afffc16

Affected versions

8.*

8.0.0
8.0.0-rc4
8.0.1
8.0.1-rc0
8.0.2
8.0.2-rc0
8.0.3
8.0.3-rc0
8.0.4
8.0.4-rc0
8.0.5
8.0.6
8.0.6-rc0
8.0.6-rc1
8.0.7
8.0.7-rc0