Skip to content
OpenAdvisories
Unscored CVE-2017-5659 EUVD-2017-14739GHSA-939c-m42f-qh77

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.

Published Apr 17, 2017 · Updated Aug 5, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Traffic Server Package: trafficserver Package: trafficserver Ecosystem: Debian Ecosystem: Ubuntu

Description

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Traffic Server All versions prior to version 6.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 trafficserver 7.0.0-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS trafficserver No fix yet —

References