The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3385 advisory.

  - Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server     allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.
    (CVE-2022-31778)

  - Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an     attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. (CVE-2022-31779)

  - Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic     Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic     Server: from 8.0.0 through 9.1.3. (CVE-2022-32749)

  - Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache     Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. (CVE-2022-37392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3385-1 : trafficserver - LTS security update

high Nessus Plugin ID 174043

Version 1.0