CVE-2020-9481
📋 TL;DR
Apache Traffic Server (ATS) versions 6.0.0-6.2.3, 7.0.0-7.1.9, and 8.0.0-8.0.6 are vulnerable to HTTP/2 slow read attacks, which allow attackers to cause denial of service by exhausting server resources. This affects organizations using vulnerable ATS versions as HTTP/2 reverse proxies or caching servers. The vulnerability exploits HTTP/2 flow control mechanisms to create resource exhaustion.
💻 Affected Systems
- Apache Traffic Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage with ATS becoming unresponsive, potentially affecting all downstream services and causing extended downtime.
Likely Case
Degraded performance, increased latency, and intermittent service disruptions affecting HTTP/2 traffic.
If Mitigated
Minimal impact with proper rate limiting, connection limits, and monitoring in place.
🎯 Exploit Status
HTTP/2 slow read attacks are well-documented and tools exist to exploit similar vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.4, 7.1.10, 8.0.7
Vendor Advisory: https://lists.apache.org/thread.html/r21ddaf0a4a973f3c43c7ff399ae50d2f858f13f87bd6a9551c5cf6db%40%3Cannounce.trafficserver.apache.org%3E
Restart Required: Yes
Instructions:
1. Download patched version from Apache website. 2. Backup current configuration. 3. Stop ATS service. 4. Install patched version. 5. Restart ATS service. 6. Verify functionality.
🔧 Temporary Workarounds
Disable HTTP/2
allTemporarily disable HTTP/2 protocol support to mitigate the vulnerability
# Edit records.config and set CONFIG proxy.config.http2.enabled INT 0
# Then restart ATS: traffic_server -C restart
Limit HTTP/2 connections
allReduce maximum concurrent HTTP/2 connections to limit attack impact
# Edit records.config and adjust: CONFIG proxy.config.http2.max_concurrent_streams_in INT 100
# CONFIG proxy.config.http2.max_active_streams_in INT 100
🧯 If You Can't Patch
- Implement rate limiting and connection throttling for HTTP/2 traffic
- Deploy WAF or load balancer with HTTP/2 attack protection in front of ATS
🔍 How to Verify
Check if Vulnerable:
Check ATS version with: traffic_server -V | grep 'Apache Traffic Server'Check Version:
traffic_server -V | grep 'Apache Traffic Server'Verify Fix Applied:
Verify version is 6.2.4+, 7.1.10+, or 8.0.7+ and test HTTP/2 functionality📡 Detection & Monitoring
Log Indicators:
- Unusually high number of HTTP/2 connections
- Increased connection timeouts
- High memory usage alerts
- Slow response times for HTTP/2 requests
Network Indicators:
- Excessive HTTP/2 connections from single sources
- Abnormal HTTP/2 flow control patterns
- Sustained low-bandwidth HTTP/2 transfers
SIEM Query:
source="ats_logs" AND (http_version="2" AND (connection_duration > 30 OR bytes_sent < 100 AND bytes_received > 10000))🔗 References
- https://lists.apache.org/thread.html/r21ddaf0a4a973f3c43c7ff399ae50d2f858f13f87bd6a9551c5cf6db%40%3Cannounce.trafficserver.apache.org%3E
- https://www.debian.org/security/2020/dsa-4672
- https://lists.apache.org/thread.html/r21ddaf0a4a973f3c43c7ff399ae50d2f858f13f87bd6a9551c5cf6db%40%3Cannounce.trafficserver.apache.org%3E
- https://www.debian.org/security/2020/dsa-4672
