CVE-2018-11783

Name	CVE-2018-11783
Description	sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
trafficserver (PTS)	buster	8.0.2+ds-1+deb10u6	fixed
	buster (security)	8.1.7-0+deb10u4	fixed
	bullseye	8.1.9+ds-1~deb11u1	fixed
	bullseye (security)	8.1.10+ds-1~deb11u1	fixed
	bookworm	9.2.3+ds-1+deb12u1	fixed
	bookworm (security)	9.2.4+ds-0+deb12u1	fixed
	sid	9.2.4+ds-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
trafficserver	source	wheezy	(unfixed)	end-of-life
trafficserver	source	(unstable)	8.0.2+ds-1

https://github.com/apache/trafficserver/pull/4701
https://www.openwall.com/lists/oss-security/2019/02/13/6