CVE-2020-17509

NameCVE-2020-17509
DescriptionATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4805-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
trafficserver (PTS)buster8.0.2+ds-1+deb10u3vulnerable
buster (security)8.0.2+ds-1+deb10u4fixed
bullseye, sid8.1.1+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
trafficserversourcebuster8.0.2+ds-1+deb10u4DSA-4805-1
trafficserversource(unstable)8.1.1+ds-1

Notes

https://github.com/apache/trafficserver/pull/7359
https://lists.apache.org/thread.html/raa9f0589c26c4d146646425e51e2a33e1457492df9f7ea2019daa6d3%40%3Cdev.trafficserver.apache.org%3E
Search for package or bug name: Reporting problems