There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests     interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To     resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should     upgrade to 7.1.4 or later versions. (CVE-2018-8004)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the result of a remote check, the target Apache Traffic Server does not have a patch applied to mitigate HTTP Smuggling and HTTP cache poisoning which was put in place in versions greater than 6.2.3 and 7.1.4. A remote unauthenticated attacker could exploit this to gain access to backend resources that they would otherwise not have access to.

Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in denial of service, cache poisoning or information disclosure.

ID	Name	Product	Family	Severity
254589	Linux Distros Unpatched Vulnerability : CVE-2018-8004	Nessus	Misc.	medium
136931	Apache Traffic Server - HTTP Smuggling and Cache poisoning	Nessus	Web Servers	medium
112232	Debian DSA-4282-1 : trafficserver - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-8004

medium

Tenable Plugins

medium

medium

medium