Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue     affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version     9.2.3, which fixes the issue. (CVE-2023-39456)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue
    affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version
    9.2.3, which fixes the issue. (CVE-2023-39456)

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This
    issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are
    recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue. (CVE-2023-41752)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation
    can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1caffb88af advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5549 advisory.

    Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server,     which could result in denial of service or information disclosure. For the oldstable distribution     (bullseye), these problems have been fixed in version 8.1.9+ds-1~deb11u1. For the stable distribution     (bookworm), these problems have been fixed in version 9.2.3+ds-1+deb12u1. We recommend that you upgrade     your trafficserver packages. For the detailed security status of trafficserver please refer to its     security tracker page at: https://security-tracker.debian.org/tracker/trafficserver

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-54fadada12 advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5ff7bf1dd8 advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
251064	Linux Distros Unpatched Vulnerability : CVE-2023-39456	Nessus	Misc.	high
426255	Alpine: multiple trafficserver9 packages, perl-trafficserver9: security update to 9.2.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426255	Alpine: multiple trafficserver9 packages, perl-trafficserver9: security update to 9.2.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
185257	Fedora 39 : trafficserver (2023-1caffb88af)	Nessus	Fedora Local Security Checks	critical
184442	Debian DSA-5549-1 : trafficserver - security update	Nessus	Debian Local Security Checks	critical
183453	Fedora 37 : trafficserver (2023-54fadada12)	Nessus	Fedora Local Security Checks	critical
183451	Fedora 38 : trafficserver (2023-5ff7bf1dd8)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-39456

high

Tenable Plugins

high

medium

medium

critical

critical

critical

critical