{"id":"CVE-2018-8022","aliases":["DEBIAN-CVE-2018-8022","EUVD-2018-19722","GHSA-gw79-rp24-2pgc","UBUNTU-CVE-2018-8022"],"status":"published","title":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This...","description":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07402,"percentile":0.94474,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-08-29T13:00:00Z","modified":"2026-10-23T18:03:09Z","fixes":[{"ecosystem":"Debian:12","package":"trafficserver","fixed_in":["7.0.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1"}]}]}],"products":[{"vendor":"apache","product":"traffic_server"},{"vendor":"apache software foundation","product":"apache traffic server"}],"references":[{"url":"https://lists.apache.org/thread.html/ce404d2fe16cc59085ece5a6236ccd1549def471a2a9508198d966b1%40%3Cusers.trafficserver.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/105183","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/apache/trafficserver/pull/2147","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8022"},{"url":"https://lists.apache.org/thread.html/ce404d2fe16cc59085ece5a6236ccd1549def471a2a9508198d966b1@%3Cusers.trafficserver.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-gw79-rp24-2pgc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-8022","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-8022","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/08/29/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8022","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-8022","description":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.","status":"published","published":"2018-08-29T13:00:00Z","modified":"2024-09-16T21:57:30.534Z","updated_at":"2026-11-02T14:35:04.540365Z"}],"euvd":[{"id":"EUVD-2018-19722","description":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.","status":"published","published":"2018-08-29T13:00:00Z","modified":"2024-09-16T21:57:30Z","updated_at":"2026-11-03T00:55:07.221362Z"}],"ghsa":[{"id":"GHSA-gw79-rp24-2pgc","title":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This...","description":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.","status":"published","published":"2022-05-14T02:20:38Z","modified":"2023-02-02T05:05:38Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:09.236869Z"}],"nvd":[{"id":"CVE-2018-8022","description":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.","status":"published","published":"2018-08-29T13:29:02.107Z","modified":"2026-06-17T02:04:06.747Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"CVE-2018-8022","description":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.","status":"published","published":"2018-08-29T13:29:02.107Z","modified":"2026-10-20T10:50:31.012643362Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-8022","description":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.","status":"published","published":"2018-08-29T13:29:02.107Z","modified":"2026-10-23T18:03:09.16422333Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2018-8022","description":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.","status":"withdrawn","published":"2018-08-29T13:29:00Z","modified":"2025-07-16T07:39:04.541023Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"}]}}