3 results · Clear filters · Feed
-
High 7.5
Apache Traffic Control: ReDoS issue in Traffic Router configuration
** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This issue affects Apache Traffic Control: all versions. People with access to the management interface of the Traffic Router component could sp…
-
High 7.5
Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
-
High 7.5
Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack
The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes …