[ANNOUNCE] Apache Traffic Server vulnerability with header variable access in the ESI plugin - CVE-2018-8040

Bryan Call <[email protected]> Tue, 28 Aug 2018 15:39:51 -0700

Newsgroups	gmane.comp.security.oss.general,gmane.comp.jakarta.avalon.user,gmane.comp.apache.maven.announce,gmane.comp.apache.sling.devel
Message-ID	<B78D2067-1658-4D7F-804C-FC6CE9A99680__48933.2445584752$1535529248$gmane$org@apache.org>

CVE-2018-8040: Apache Traffic Server vulnerability with header variable =
access in the ESI plugin

Reported By:
Louis Dion-Marcil

Vendor:
The Apache Software Foundation

Version Affected:
ATS 6.0.0 to 6.2.2
ATS 7.0.0 to 7.1.2

Description:
Pages that are rendered using the ESI plugin can have access to the =
cookie header when the plugin is configure not to allow access.

Mitigation:
6.x users should upgrade to 6.2.3 or later versions
7.x users should upgrade to 7.1.3 or later versions

References:
	Downloads:
		https://trafficserver.apache.org/downloads
	Github Pull Request:
		https://github.com/apache/trafficserver/pull/3926
	CVE:
		=
https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2018-8040

-Bryan