Fedora 43 : trafficserver (2026-ddaabe38ab)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-ddaabe38ab
#

include('compat.inc');

if (description)
{
  script_id(330082);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/27");

  script_cve_id("CVE-2026-59173");
  script_xref(name:"FEDORA", value:"2026-ddaabe38ab");

  script_name(english:"Fedora 43 : trafficserver (2026-ddaabe38ab)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-ddaabe38ab advisory.

    Resolves CVE-2026-59173 - DoS vulnerability in HTTP/2 via stalled flow-control

    Additional Changes with Apache Traffic Server 9.2.14
      #12910 - Fix connection-level window mismatch causing 408/504 timeouts
      #13266 - Add Claude Code project guide for the 9.2.x branch
      #13267 - [9.2.x] Backport format scripts fixes
      #13377 - 9.2.x: http2: Track scheduled events

    Additional Changes with Apache Traffic Server 10.1.3
      #12192 - Return a 400 on chunk parse errors
      #12733 - Fix retry logic for TSHttpTxnServerAddrSet (issue #12611)
      #12854 - Fix LoadedPlugins::remove crash during static destruction
      #12855 - Fix header_rewrite run-plugin relative path resolution
      #12857 - Fix autest compatibility with Fedora 43 / Python 3.14
      #12943 - Address incompatibility with BoringSSL
      #12959 - Fix crash in HttpSM::tunnel_handler on unhandled VC events
      #12972 - Fix cache retry assert on ServerAddrSet
      #12990 - Update to Proxy Verifier v3.0.0
      #13008 - cmake: limit GENERAL_NAME bssl probe
      #13020 - Align AuTests with latest proxy-verifier checks (#12986)
      #13025 - hrw: Refix loading geodb files
      #13033 - tests/gold_tests/headers tests: use ATSReplayTest
      #13113 - slice: Fix crash caused by use-after-free
      #13114 - Fix bg fill teardown crash in update_size_and_time_stats
      #13138 - Remove cache alternate vector detach
      #13144 - Fix XPACK relative index underflow
      #13162 - hrw: Fix an index bug in run plugin operator
      #13177 - Correct records.yaml record drift
      #13178 - 10.1.x: proxy.config.dns.search_default_domains: allow 2
      #13182 - Stabilize parallel AuTest helpers
      #13192 - yaml-cpp-0.9.0
      #13193 - GCC 16: Regex header integer includes
      #13198 - Fedora 44 test fixes
      #13200 - Single source of truth for Proxy Verifier metadata
      #13217 - Proxy Verifier v3.1.3
      #13218 - Fix hdrHeap/hdrStrHeap allocator inuse metric underflow
      #13220 - Fix flaky Fedora 44 AuTest helpers
      #13223 - Fix mismatched sINT/dINT log field types
      #13252 - cache: apply per-volume settings on first start after clear
      #13256 - Fix mismatched log field types more
      #13261 - header_rewrite: Improve URL Error messages
      #13263 - Fix bounds check in CacheVC::scanObject
      #13264 - Handle OpenSSL without dynamic ENGINE
      #13280 - Enable probes in Fedora C++20 CI
      #13293 - ProxyProtocol: free pp_info heap on NetVConnection recycle
      #13294 - Fix pending HostDB DNS queue removal race
      #13295 - Fix server entry cleanup after request tunnel setup
      #13297 - 10.1.x: Add sni.yaml session ticket overrides (#13006)
      #13303 - header_rewrite: Fix a leak and truncation in set-body-from
      #13307 - dns: destruct HostEnt on free to fix SRV vector leak
      #13318 - TLS: Fix memory leaks in cert load and OCSP stapling
      #13325 - HttpSM.cc: fix cache read end milestone order
      #13336 - 10.1.x: Fix redirected cache write without write VC
      #13365 - 10.1.x: USDT: normalize names for STATE_ENTER
      #13366 - 10.1.x: Fix set-status crash inside if/endif at remap time
      #13387 - Hard-enforce max_active_streams_in at HTTP/2 stream creation


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-ddaabe38ab");
  script_set_attribute(attribute:"solution", value:
"Update the affected trafficserver package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-59173");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:43");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:trafficserver");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^43([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 43', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '43',
    'pkgs': [
      {'reference':'trafficserver-10.1.3-1.fc43', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'trafficserver');
}