Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation     Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0. (CVE-2022-47184)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3475 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3475-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     June 30, 2023                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : trafficserver     Version        : 8.1.7-0+deb10u1     CVE ID         : CVE-2022-47184 CVE-2023-30631 CVE-2023-33933     Debian Bug     : 1038248

    Several vulnerabilities were discovered in Apache Traffic Server,     a reverse and forward proxy server.

    CVE-2022-47184

        The TRACE method can be used to disclose network information.

    CVE-2023-30631

        Configuration option to block the PUSH method in ATS didn't work.<

    CVE-2023-33933

        s3_auth plugin problem with hash calculation.

    For Debian 10 buster, these problems have been fixed in version     8.1.7-0+deb10u1.

    We recommend that you upgrade your trafficserver packages.

    For the detailed security status of trafficserver please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/trafficserver

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2e6bead58b advisory.

    Update to upstream 9.2.1; resolves CVE-2022-47184, CVE-2023-30631, CVE-2023-33933


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-92686b3e8b advisory.

    Update to upstream 9.2.1; resolves CVE-2022-47184, CVE-2023-30631, CVE-2023-33933

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5435 advisory.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation     Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0. (CVE-2022-47184)

  - Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The     configuration option proxy.config.http.push_method_enabled didn't function. However, by default the PUSH     method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0     through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or     later versions (CVE-2023-30631)

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation     Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should     upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions (CVE-2023-33933)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257721	Linux Distros Unpatched Vulnerability : CVE-2022-47184	Nessus	Misc.	high
177811	Debian dla-3475 : trafficserver - security update	Nessus	Debian Local Security Checks	high
177544	Fedora 38 : trafficserver (2023-2e6bead58b)	Nessus	Fedora Local Security Checks	high
177541	Fedora 37 : trafficserver (2023-92686b3e8b)	Nessus	Fedora Local Security Checks	high
177482	Debian DSA-5435-1 : trafficserver - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2022-47184

high

Tenable Plugins

high

high

high

high

high