Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-9494

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.

Published

2020-06-24T16:15:11.067

Last Modified

2024-11-21T05:40:46.143

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-770

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apache	traffic_server	≤ 6.2.3	Yes
Application	apache	traffic_server	≤ 7.1.10	Yes
Application	apache	traffic_server	≤ 8.0.7	Yes
Operating System	debian	debian_linux	10.0	Yes

References

http://www.openwall.com/lists/oss-security/2021/03/01/2 Not Applicable ([email protected])
https://lists.apache.org/thread.html/rf7f86917f42fdaf904d99560cba0c016e03baea6244c47efeb60ecbe%40%3Cdev.trafficserver.apache.org%3E Mailing List, Vendor Advisory ([email protected])
https://www.debian.org/security/2020/dsa-4710 Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/03/01/2 Not Applicable (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rf7f86917f42fdaf904d99560cba0c016e03baea6244c47efeb60ecbe%40%3Cdev.trafficserver.apache.org%3E Mailing List, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2020/dsa-4710 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)