The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3475 advisory.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation     Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0. (CVE-2022-47184)

  - Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The     configuration option proxy.config.http.push_method_enabled didn't function. However, by default the PUSH     method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0     through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or     later versions (CVE-2023-30631)

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation     Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should     upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions (CVE-2023-33933)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3475-1 : trafficserver - LTS security update

high Nessus Plugin ID 177811

Version 1.0