CVE-2021-38161

CWE-287 — Improper Authentication5 documents5 sources

Severity

8.1HIGH

EPSS

1.2%

top 21.36%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Traffic Server Apache Software Foundation Apache Traffic Server Debian Debian Linux

Timeline

PublishedNov 3

Latest updateMay 24

Description

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/traffic_server8.0.0 — 8.0.8

▶CVEListV5apache_software_foundation/apache_traffic_server8.0.0 to 8.0.8

▶Debiantrafficserver< 8.1.1+ds-1.1+deb11u1+1

Also affects: Debian Linux 10.0, 11.0

Patches

Patch: lists.apache.org ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

GHSA

GHSA-wp25-8fm6-33wm: Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks↗2022-05-24

▶

CVEList

Not validating origin TLS certificate↗2021-11-03

▶

OSV

CVE-2021-38161: Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks↗2021-11-03

▶

📋Vendor Advisories

Debian

CVE-2021-38161: trafficserver - Improper Authentication vulnerability in TLS origin verification of Apache Traff...↗2021

▶