CVE-2021-43082

2021-11-0316:15:08

Debian Security Bug Tracker

security-tracker.debian.org

cve-2021-43082

buffer overflow

apache traffic server

stats-over-http

vulnerability

memory overwrite

unix

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.4%

JSON

Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.

OSVersionArchitecturePackageVersionFilename
Debian12alltrafficserver< 9.1.1+ds-1trafficserver_9.1.1+ds-1_all.deb
Debian11alltrafficserver< 8.1.10+ds-1~deb11u1trafficserver_8.1.10+ds-1~deb11u1_all.deb
Debian999alltrafficserver< 9.1.1+ds-1trafficserver_9.1.1+ds-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	trafficserver	< 9.1.1+ds-1	trafficserver_9.1.1+ds-1_all.deb
Debian	11	all	trafficserver	< 8.1.10+ds-1~deb11u1	trafficserver_8.1.10+ds-1~deb11u1_all.deb
Debian	999	all	trafficserver	< 9.1.1+ds-1	trafficserver_9.1.1+ds-1_all.deb