~ / search / GHSA-gw97-f6h8-gm94

GHSA-gw97-f6h8-gm94

Email relay in Apache Traffic Control

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-42009

Packages

EcosystemPackageAffectedFixed in
Go github.com/apache/trafficcontrol < 5.1.3 5.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.

References

External links from the advisory. They lead to third-party sites.