There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers.

 

Overview :
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions.

CVE-2020-1944

Subject: [ANNOUNCE] Apache Traffic Server is vulnerable to various smugging attacks
Date: 2020/03/10 22:35:10
List: announce@trafficserver.apache.org

Description:
ATS is vulnerable to various smugging attacks

CVE:
CVE-2020-1944
CVE-2019-17565
CVE-2019-17559

Reported By:
ZeddYu Lu (CVE-2020-1944)

Vendor:
The Apache Software Foundation

Version Affected:
ATS 6.0.0 to 6.2.3
ATS 7.0.0 to 7.1.8
ATS 8.0.0 to 8.0.5

Mitigation:
6.x users should upgrade to 7.1.9, 8.0.6, or later versions
7.x users should upgrade to 7.1.9 or later versions
8.x users should upgrade to 8.0.6 or later versions

References:
	Downloads:
		https://trafficserver.apache.org/downloads
		(Please use backup sites from the link only if the mirrors are unavailable) 
	CVE:
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1944
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17565
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17559

Common Vulnerabilityies and Exposures

Internet Download Manager 6.37.11.1 Export/Import stack-based overflow

A vulnerability, which was classified as critical, was found in Internet Download Manager 6.37.11.1. This affects an unknown code block of the component Export/Import. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Passcovery ZIP Password Recovery 3.70.69.0 Decompression buffer overflow

A vulnerability classified as critical was found in Passcovery ZIP Password Recovery 3.70.69.0. Affected by this vulnerability is an unknown part of the component Decompression. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Portable Playable 9.18 JPEG File filename unrestricted upload

A vulnerability, which was classified as critical, has been found in Portable Playable 9.18. Affected by this issue is an unknown code of the component JPEG File Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.