[ANNOUNCE] Apache Traffic Server host header and line folding - CVE-2017-5660

[Bryan Call]

CVE-2017-5660: Apache Traffic Server host header and line folding

Vendor:
The Apache Software Foundation

Version Affected:
ATS 6.2.0 and prior
ATS 7.0.0 and prior

Description:
There is a vulnerability in ATS with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.

Mitigation:
6.2.x users should upgrade to 6.2.2 or later versions
7.x users should upgrade to 7.1.2 or later versions

References:
Downloads:
https://trafficserver.apache.org/downloads

Github Pull Request:
https://github.com/apache/trafficserver/pull/1657

CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5660

-Bryan

[Jeremy Payne]

Is it safe to conclude that in terms of request routing, that this CVE
only applies to proxies in forward proxy mode ? Or rather forward
proxies that parse the host header to determine next hop ?
In reverse proxy mode, where remap rules are explicitly defined, then
a request either matches a remap or the request is denied.

Please advise.

Post by Bryan Call
CVE-2017-5660: Apache Traffic Server host header and line folding
The Apache Software Foundation
ATS 6.2.0 and prior
ATS 7.0.0 and prior
There is a vulnerability in ATS with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
6.2.x users should upgrade to 6.2.2 or later versions
7.x users should upgrade to 7.1.2 or later versions
https://trafficserver.apache.org/downloads
https://github.com/apache/trafficserver/pull/1657
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5660
-Bryan

[Leif Hedstrom]

Post by Jeremy Payne
Is it safe to conclude that in terms of request routing, that this CVE
only applies to proxies in forward proxy mode ? Or rather forward
proxies that parse the host header to determine next hop ?
In reverse proxy mode, where remap rules are explicitly defined, then
a request either matches a remap or the request is denied.
Please advise.

If I recall, this can be used in any proxy mode. A well crafted request could for example cause an origin or different upstream parent, to look at the wrong host header, which could be bad if that origin handles different hosts differently.

— leif