Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic     Server.This issue affects Apache Traffic Server: through 9.2.1. (CVE-2022-47185)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5549 advisory.

    Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server,     which could result in denial of service or information disclosure. For the oldstable distribution     (bullseye), these problems have been fixed in version 8.1.9+ds-1~deb11u1. For the stable distribution     (bookworm), these problems have been fixed in version 9.2.3+ds-1+deb12u1. We recommend that you upgrade     your trafficserver packages. For the detailed security status of trafficserver please refer to its     security tracker page at: https://security-tracker.debian.org/tracker/trafficserver

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3595 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3595-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     September 30, 2023                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : trafficserver     Version        : 8.1.7-0+deb10u2     CVE ID         : CVE-2022-47185 CVE-2023-33934     Debian Bug     : 1043430

    Several cases of improper input validation were fixed in Apache Traffic Server,     a reverse and forward proxy server.

    For Debian 10 buster, these problems have been fixed in version     8.1.7-0+deb10u2.

    We recommend that you upgrade your trafficserver packages.

    For the detailed security status of trafficserver please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/trafficserver

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-dcbfbf1396 advisory.

    Update to upstream 9.2.2.

    Changes with Apache Traffic Server 9.2.2       #9544 - Docs: format typos in header_rewrite doc       #9754 - Fix OCSP detection during build (9.2.x)       #9829 - Add TSHttpTxnNextHopPortGet, add NEXT-HOP to header rewrite       #9831 - Allow slice plugin to purge requests       #9840 - Fix crash on config reload with BoringSSL       #9877 - Do not add content-length for status 204 cache       #9879 - doc: fix the internal libraries section formatting       #9886 - Fix deprecated set_class for documentation build       #9943 - Add yaml libs reference to HTTP proxy test suite.
      #9944 - Fix clang-format for 9.2.x branch       #9952 - 92x autest updates       #9959 - 9.2.x: OpenSSL 3.0 tls autest updates (#9947)       #9971 - Update to autest version 1.10.3       #9976 - fix: require RSRC_CLIENT_REQUEST_HEADERS in ConditionMethod       #9989 - Do not set @SECLEVEL with boringssl       #10038 - LSan: Fix leaks of Cache Unit Test       #10054 - Demote SSL log line to debug and remove key printing       #10093 - tools/check-unused-dependencies:  make exceptions for tools under clang+asan       #10103 - autest get_port: update to use psutil       #10105 - Update autest to the latest 1.10.4       #10107 - Fix ports.py type hint for sets on older Python       #10124 - Fix DbgCtl reference that got cherry-picked into 9.2.x       #10125 - Remove duplicate slashes at the beginning of the incoming URL       #10127 - 9.2.x: Correctly handle encoding for cache hash generation       #10131 - 9.2.x: Fix a crash triggered by invalid range header



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259018	Linux Distros Unpatched Vulnerability : CVE-2022-47185	Nessus	Misc.	high
184442	Debian DSA-5549-1 : trafficserver - security update	Nessus	Debian Local Security Checks	critical
182405	Debian dla-3595 : trafficserver - security update	Nessus	Debian Local Security Checks	critical
179959	Fedora 38 : trafficserver (2023-dcbfbf1396)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2022-47185

high

Tenable Plugins

high

critical

critical

critical