Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1caffb88af advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3645 advisory.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This     issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are     recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue. (CVE-2023-41752)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5549 advisory.

  - Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic     Server.This issue affects Apache Traffic Server: through 9.2.1. (CVE-2022-47185)

  - Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue     affects Apache Traffic Server: through 9.2.1. (CVE-2023-33934)

  - Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue     affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version     9.2.3, which fixes the issue. (CVE-2023-39456)

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This     issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are     recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue. (CVE-2023-41752)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-54fadada12 advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5ff7bf1dd8 advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185257	Fedora 39 : trafficserver (2023-1caffb88af)	Nessus	Fedora Local Security Checks	critical
184444	Debian DLA-3645-1 : trafficserver - LTS security update	Nessus	Debian Local Security Checks	high
184442	Debian DSA-5549-1 : trafficserver - security update	Nessus	Debian Local Security Checks	critical
183453	Fedora 37 : trafficserver (2023-54fadada12)	Nessus	Fedora Local Security Checks	critical
183451	Fedora 38 : trafficserver (2023-5ff7bf1dd8)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-41752

high

Tenable Plugins

critical

high

critical

critical

critical