Skip to content
OpenAdvisories
Unscored CVE-2018-1318 EUVD-2018-11914GHSA-3mf6-hp9h-pxf7

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traff…

Published Aug 29, 2018 · Updated Sep 16, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Traffic Server Package: trafficserver Package: trafficserver Ecosystem: Debian Ecosystem: Ubuntu

Description

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Traffic Server 6.0.0 to 6.2.2, 7.0.0 to 7.1.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 trafficserver 7.1.4+ds-1 —
Debian 9 trafficserver 7.0.0-6+deb9u2 DSA-4282-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS trafficserver No fix yet —
Ubuntu 16.04 LTS trafficserver No fix yet —

Advisories 1

References