CVE-2021-37147
published 2021-11-03CVE-2021-37147: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
2.44%
82.5th percentile
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | 8.0.0 – 8.1.2 | — |
| apache | traffic_server | 9.0.0 – 9.1.0 | — |
| apache_software_foundation | apache_traffic_server | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | trafficserver | < trafficserver 9.1.1+ds-1 (bookworm) | trafficserver 9.1.1+ds-1 (bookworm) |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2c64-8v4j-vw3m: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests
ghsa_unreviewed·2022-05-24
CVE-2021-37147 [HIGH] CWE-20 GHSA-2c64-8v4j-vw3m: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
OSV
CVE-2021-37147: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests
osv·2021-11-03·CVSS 7.5
CVE-2021-37147 [HIGH] CVE-2021-37147: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
Debian
CVE-2021-37147: trafficserver - Improper input validation vulnerability in header parsing of Apache Traffic Serv...
vendor_debian·2021·CVSS 7.5
CVE-2021-37147 [HIGH] CVE-2021-37147: trafficserver - Improper input validation vulnerability in header parsing of Apache Traffic Serv...
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
Scope: local
bookworm: resolved (fixed in 9.1.1+ds-1)
bullseye: resolved (fixed in 8.1.1+ds-1.1+deb11u1)
sid: resolved (fixed in 9.1.1+ds-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Improper Input Validation
mitre_cwe
CWE-20 Improper Input Validation
CWE-20: Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
Input validation is a frequently-used technique
for checking potentially dangerous inputs in order to
ensure that the inputs are safe for processing within the
code, or when communicating with other components. Input can consist of: raw data - strings, numbers, parameters, file contents, etc. metadata - information about the raw data, such as headers or size Data can be simple or structured. Structured data
can be composed of many nested layers, composed of
combinations of metadata and raw data, with other simple or
structured data. Many properties of raw data or metadata may n
CWE
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
mitre_cwe
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
(such as a proxy or firewall) in the data flow between two
entities such as a client and server, but it does not
interpret malformed HTTP requests or responses in ways that
are consistent with how the messages will be processed by
those entities that are at the ultimate destination.
HTTP requests or responses ("messages") can be
malformed or unexpected in ways that cause web servers or
clients to interpret the messages in different ways than
intermediary HTTP agents such as load balancers, reverse
proxies, web caching proxies, application firewalls,
etc. For example, an adversary may be able to add duplicate
or different header fields that a client or s
2021-11-03
Published