CVE-2018-8005
moderate-risk
Published 2018-08-29
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
Do I need to act?
~
6.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10
Medium
NETWORK
/ LOW complexity
Affected Products (2)
References (10)
Third Party Advisory
http://www.securityfocus.com/bid/105187
Third Party Advisory
https://github.com/apache/trafficserver/pull/3106
Third Party Advisory
https://github.com/apache/trafficserver/pull/3124
Third Party Advisory
https://www.debian.org/security/2018/dsa-4282
Third Party Advisory
http://www.securityfocus.com/bid/105187
Third Party Advisory
https://github.com/apache/trafficserver/pull/3106
Third Party Advisory
https://github.com/apache/trafficserver/pull/3124
Third Party Advisory
https://www.debian.org/security/2018/dsa-4282
37
/ 100
moderate-risk
Severity
21/34 · High
Exploitability
9/34 · Low
Exposure
7/34 · Low