CVE-2017-7671 There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.
HighCVSS 7.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/trafficserver(Debian:12) | < 7.1.2+ds-1 | 7.1.2+ds-1 |
| apache traffic server | >= 5.2.0, <= 5.3.2 | No fix listed |
| apache traffic server | >= 6.0.0, <= 6.2.0 | No fix listed |
| apache traffic server | = 7.0.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Apache Traffic Server | = 5.2.0 to 5.3.2 | No fix listed |
| Apache Traffic Server | = 6.0.0 to 6.2.0 | No fix listed |
| Apache Traffic Server | = 7.0.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-7671 vendor-advisory
- [dev] 20180227 [ANNOUNCE] Apache Traffic Server vulnerability with TLS handshake - CVE-2017-7671 mailing-list
- DSA-4128 third-party-advisory vendor-advisory