CVE-2018-1318 Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve...
HighCVSS 7.5
EPSS 7.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/trafficserver(Debian:12) | < 7.1.4+ds-1 | 7.1.4+ds-1 |
| apache traffic server | >= 6.0.0, <= 6.2.2 | No fix listed |
| apache traffic server | >= 7.0.0, <= 7.1.3 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Apache Traffic Server | = 6.0.0 to 6.2.2 | No fix listed |
| Apache Traffic Server | = 7.0.0 to 7.1.3 | No fix listed |
References
- Debian Security Tracker CVE-2018-1318 vendor-advisory
- 105176 third-party-advisory vdb-entry
- github.com third-party-advisory
- [trafficserver-users] 20180828 [ANNOUNCE] Apache Traffic Server vulnerability with method ACLs - CVE-2018-1318 mailing-list
- DSA-4282 third-party-advisory vendor-advisory