CVE-2018-8005 — Uncontrolled Resource Consumption in Apache Traffic Server

CWE-400 — Uncontrolled Resource Consumption5 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
6.7%
top 8.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apache Traffic ServerApache Software Foundation Apache Traffic ServerDebian Linux
Timeline
PublishedAug 29
Latest updateMay 13

Description

When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/traffic_server6.0.0 — 6.2.2+1
▶CVEListV5apache_software_foundation/apache_traffic_server6.0.0 to 6.2.2, 7.0.0 to 7.1.3+1

Also affects: Debian Linux 9.0

🔴Vulnerability Details

3
GHSA
GHSA-98hg-h5w7-368p: When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache↗2022-05-13
▶
CVEList
CVE-2018-8005: When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache↗2018-08-29
▶
OSV
CVE-2018-8005: When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache↗2018-08-29
▶

📋Vendor Advisories

1
Debian
CVE-2018-8005: trafficserver - When there are multiple ranges in a range request, Apache Traffic Server (ATS) w...↗2018
▶
CVE-2018-8005 — Uncontrolled Resource Consumption | cvebase