UBUNTU-CVE-2018-8040
Dashboard / Vulnerabilities / UBUNTU-CVE-2018-8040
Summary:
Details: Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
References: https://ubuntu.com/security/CVE-2018-8040, http://www.openwall.com/lists/oss-security/2018/08/29/2, https://github.com/apache/trafficserver/pull/3926, https://github.com/apache/trafficserver/commit/cea07c03274807c1588dbdf03baa1537d958c92f, https://www.cve.org/CVERecord?id=CVE-2018-8040
Affected packages
Package
Name: trafficserver
Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
