==================================================================== CERT-Renater Note d'Information No. 2020/VULN664 _____________________________________________________________________ DATE : 08/12/2020 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Traffic Server versions prior to 7.1.12, 8.0.8, 8.1.1. ===================================================================== http://mail-archives.apache.org/mod_mbox/trafficserver-announce/202012.mbox/%3c3CDA1E5F-A0F2-4497-8051-9E9DA5B69574@apache.org%3e http://mail-archives.apache.org/mod_mbox/trafficserver-announce/202012.mbox/%3c77C19AB7-752D-4FD3-808B-6B6B1A406A6A@apache.org%3e http://mail-archives.apache.org/mod_mbox/trafficserver-announce/202012.mbox/%3cC1C73187-1014-4933-B4C2-948785ED9865@apache.org%3e _____________________________________________________________________ Description: ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. CVE: CVE-2020-17509 Vendor: The Apache Software Foundation Version Affected: ATS 6.0.0 to 6.2.3 ATS 7.0.0 to 7.1.10 ATS 8.0.0 to 8.0.7 Mitigation: 6.x users should upgrade to 7.1.11, 8.0.8, or later versions 7.x users should upgrade to 7.1.11 or later versions 8.x users should upgrade to 8.0.8 or later versions References: Downloads: https://trafficserver.apache.org/downloads (Please use backup sites from the link only if the mirrors are unavailable) CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17509 -Bryan _____________________________________________________________________ Description: The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. CVE: CVE-2020-17508 Vendor: The Apache Software Foundation Version Affected: ATS 6.0.0 to 6.2.3 ATS 7.0.0 to 7.1.11 ATS 8.0.0 to 8.1.0 Mitigation: 6.x users should upgrade to 7.1.12, 8.1.1, or later versions 7.x users should upgrade to 7.1.12 or later versions 8.x users should upgrade to 8.1.1 or later versions References: Downloads: https://trafficserver.apache.org/downloads (Please use backup sites from the link only if the mirrors are unavailable) CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17508 -Bryan ______________________________________________________________________ Apache Traffic Server 8.1.1 and 7.1.12 are Released The Apache Software Foundation and the Apache Traffic Server (ATS) Project are pleased to announce the release of Apache Traffic Server 8.1.1 and 7.1.12! ATS is a high performance, scalable HTTP Intermediary and proxy cache. It is used by several large internet services, providing billions of users fast web site access and downloads. This releases are immediately available for download at: https://trafficserver.apache.org/downloads When upgrading to a new major version you will need to recompile user written plugins. Upgrading from previous releases (v3.2.0 and later) to 8.1.1 and 7.1.12 should preserve the existing cache, and not require it to be cleared. Information about what is new in the major releases can be found here: https://cwiki.apache.org/confluence/display/TS/What%27s+New+in+v8.0.x https://cwiki.apache.org/confluence/display/TS/What%27s+New+in+v7.1.x This is a bug-fix release over the previous 8.1.0 and 7.1.11 releases. When upgrading from a previous major releases, please see the upgrade details at: https://cwiki.apache.org/confluence/display/TS/Upgrading+to+v8.0 https://cwiki.apache.org/confluence/display/TS/Upgrading+to+v7.0 For a list of all Issues and PRs resolved in the 8.1.1 release, please see: https://github.com/apache/trafficserver/milestone/44?closed=1 For a list of all Issues and PRs resolved in the 7.1.12 release, please see: https://github.com/apache/trafficserver/milestone/43?closed=1 A brief summary (changelog) of all fixes in the releases are also available at: https://raw.githubusercontent.com/apache/trafficserver/8.1.x/CHANGELOG-8.1.1 https://raw.githubusercontent.com/apache/trafficserver/7.1.x/CHANGELOG-7.1.12 Sincerely, -- The Apache Traffic Server Community ========================================================= + CERT-RENATER       |    tel : 01-53-94-20-44          + + 23/25 Rue Daviel   |    fax : 01-53-94-20-41         + + 75013 Paris        |    email:cert@support.renater.fr + =========================================================