Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack

高 7.5CVE-2017-7670 · GHSA-f2wr-c4c4-xjg7 · 10/07/2017 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/apache/trafficcontrol Go	`≥ 0.0.0, < 1.1.4-0.20170531185407-738c10fa1b58≥ 1.1.4, < 1.8.1≥ 2.0.0-RC0, < 2.0.0≥ 2.1.0-RC0, < 2.1.0-RC1< 0.0.0-20170531185407-738c10fa1b58`	`1.1.4-0.20170531185407-738c10fa1b581.8.12.0.02.1.0-RC10.0.0-20170531185407-738c10fa1b58`
traffic control apache	`= 1.8.1= 2.0.0≤ 1.8.0`	修正版なし

概要

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.

NVD の説明

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.

参考情報

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

github.com/apache/trafficcontrol

≥ 0.0.0, < 1.1.4-0.20170531185407-738c10fa1b58≥ 1.1.4, < 1.8.1≥ 2.0.0-RC0, < 2.0.0≥ 2.1.0-RC0, < 2.1.0-RC1< 0.0.0-20170531185407-738c10fa1b58

1.1.4-0.20170531185407-738c10fa1b581.8.12.0.02.1.0-RC10.0.0-20170531185407-738c10fa1b58

traffic control

apache

= 1.8.1= 2.0.0≤ 1.8.0

修正版なし

概要

NVD の説明

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.