| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/apache/trafficcontrol | ≥ 5.1.0, < 5.1.4≥ 5.1.0+incompatible, < 5.1.4+incompatible≥ 6.0.0, < 6.0.1≥ 6.0.0+incompatible, < 6.0.1+incompatible | 5.1.45.1.4+incompatible6.0.16.0.1+incompatible |
| traffic control | = 5.1.4= 6.0.1≥ 5.1.0, < 5.1.4≥ 6.0.0, < 6.0.1 | 5.1.46.0.1 |
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free