Improper Input Validation The advisory has been revoked - it doesn't affect any version of package trafficserver (opens in a new tab)

Threat Intelligence

4.56% (91^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU2004-TRAFFICSERVER-644874
published10 Sept 2020
disclosed22 Oct 2019

Report a new vulnerability Found a mistake?

Introduced: 22 Oct 2019

CVE-2019-10079 (opens in a new tab) CWE-20 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:20.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream trafficserver package and not the trafficserver package as distributed by Ubuntu.

Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions.