CVE-2017-5660

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.

Metrics

CVSS 3.0 8.6/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Traffic Server	6.2.0 and prior; 7.0.0 and prior

References

Timeline

Published: Feb 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-56617.3In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously CVE-2017-56627.3In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send malicio CVE-2017-56638.8In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read CVE-2017-56647.5The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error CVE-2017-56655.5The splt_cue_export_to_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer derefer CVE-2017-56665.5The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (invalid free and crash CVE-2017-56676.5The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause CVE-2017-56689.8bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execut CVE-2017-56697.8The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operati CVE-2017-56704.6Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate CVE-2017-56718.8Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have CVE-2017-56726.5Kony Enterprise Mobile Management (EMM) before 4.2.5.2 has the vulnerability of disclosing the private key in clear-text when changing the p