VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 7, 2019· Updated Jun 17, 2026

CVE-2018-11783

CVE-2018-11783

Description

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.

Affected products

3
  • Apache/trafficserver2 versions
    cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*range: >=6.0.0,<=6.0.3
    • (no CPE)range: Apache Traffic Server 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, 8.0.0 to 8.0.1
  • Apache/sslheaders pluginllm-create
    Range: 6.0.0-6.0.3, 7.0.0-7.1.5, 8.0.0-8.0.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.