Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This     issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are     recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue. (CVE-2023-41752)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue
    affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version
    9.2.3, which fixes the issue. (CVE-2023-39456)

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This
    issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are
    recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue. (CVE-2023-41752)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation
    can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1caffb88af advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3645 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3645-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     November 05, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : trafficserver     Version        : 8.1.7-0+deb10u3     CVE ID         : CVE-2023-41752 CVE-2023-44487     Debian Bug     : 1054427

    Two vulnerabilities were fixed in Apache Traffic Server,     a reverse and forward proxy server.

    CVE-2023-41752

        s3_auth plugin exposes AWSAccessKeyId

    CVE-2023-44487

        HTTP/2 Rapid Reset denial of service

    For Debian 10 buster, these problems have been fixed in version 8.1.7-0+deb10u3.

    We recommend that you upgrade your trafficserver packages.

    For the detailed security status of trafficserver please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/trafficserver

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5549 advisory.

    Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server,     which could result in denial of service or information disclosure. For the oldstable distribution     (bullseye), these problems have been fixed in version 8.1.9+ds-1~deb11u1. For the stable distribution     (bookworm), these problems have been fixed in version 9.2.3+ds-1+deb12u1. We recommend that you upgrade     your trafficserver packages. For the detailed security status of trafficserver please refer to its     security tracker page at: https://security-tracker.debian.org/tracker/trafficserver

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-54fadada12 advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5ff7bf1dd8 advisory.

    Update to upstream 9.2.3     Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259192	Linux Distros Unpatched Vulnerability : CVE-2023-41752	Nessus	Misc.	high
426255	Alpine: multiple trafficserver9 packages, perl-trafficserver9: security update to 9.2.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426255	Alpine: multiple trafficserver9 packages, perl-trafficserver9: security update to 9.2.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
185257	Fedora 39 : trafficserver (2023-1caffb88af)	Nessus	Fedora Local Security Checks	critical
184444	Debian dla-3645 : trafficserver - security update	Nessus	Debian Local Security Checks	critical
184442	Debian DSA-5549-1 : trafficserver - security update	Nessus	Debian Local Security Checks	critical
183453	Fedora 37 : trafficserver (2023-54fadada12)	Nessus	Fedora Local Security Checks	critical
183451	Fedora 38 : trafficserver (2023-5ff7bf1dd8)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-41752

high

Tenable Plugins

high

medium

medium

critical

critical

critical

critical

critical