CVE-2021-27577
Fixed in a distro release EPSS 3%
Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.
Products: Apache Software Foundation Apache Traffic Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | trafficserver | 8.0.2+ds-1+deb10u5 |
| Debian 12 | trafficserver | 8.1.1+ds-1.1 |
| Ubuntu 18.04 LTS | trafficserver | no fix |
| Ubuntu Pro 20.04 LTS | trafficserver | no fix |