Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an     attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. (CVE-2022-31779)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3385 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3385-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     April 05, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : trafficserver     Version        : 8.1.6+ds-1~deb10u1     CVE ID         : CVE-2022-31778 CVE-2022-31779 CVE-2022-32749 CVE-2022-37392

    Several vulnerabilities were discovered in Apache Traffic Server, a reverse     and forward proxy server, which could result in HTTP request smuggling, cache     poisoning or information disclosure.

    For Debian 10 buster, these problems have been fixed in version     8.1.6+ds-1~deb10u1.

    We recommend that you upgrade your trafficserver packages.

    For the detailed security status of trafficserver please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/trafficserver

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5206 advisory.

  - Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to     request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. (CVE-2021-37150)

  - Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an     attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to     9.1.2. (CVE-2022-25763)

  - Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an     attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
    (CVE-2022-28129)

  - Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server     allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.
    (CVE-2022-31778)

  - Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an     attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. (CVE-2022-31779)

  - Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an     attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. (CVE-2022-31780)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255713	Linux Distros Unpatched Vulnerability : CVE-2022-31779	Nessus	Misc.	high
174043	Debian dla-3385 : trafficserver - security update	Nessus	Debian Local Security Checks	high
164094	Debian DSA-5206-1 : trafficserver - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2022-31779

high

Tenable Plugins

high

high

high