Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apac...

References

• advisory http://www.securityfocus.com/bid/105181
• advisory https://www.debian.org/security/2018/dsa-4282
• patch https://github.com/apache/trafficserver/pull/3926
• web https://lists.apache.org/thread.html/36b3df68fe7311965f6bc4630ca413d2aa99d8f1d53affda85ea70d7%40%3Cusers.trafficserver.apache.org%3E
• web https://lists.apache.org/thread.html/cc7aa2ce1c6f4fe0c6bfef517763cdaad30ec7bcb0115b73f73f3c01%40%3Cusers.trafficserver.apache.org%3E