A new Nessus plugin (140735 - HTTP Smuggling Detection) was very recently incorporated into Tenable's PCI template and is now beeing flagged as a "medium" vulnerability and causing scans to fail.
The only info in the scan report is:
A web server was discovered on port 80/443 The below information could make the Web server a potential candidate for HTTP Smuggling
- HTTP/1.1 is supported.
I'm hoping this isn't saying that mere support for HTTP/1.1 is grounds for a failing scan, but having trouble determining what else is triggering it.
We provide software to public schools and their constituents, and still have a high % of traffic from older browsers like IE 11 and Android 4.4.4's Chromium-30 based web view, so disabling HTTP/1.1 isn't an option (nor do I see that as a configuration option offered by our web server (UWSGI) or cloud hosting provider). I've also scanned a standard CloudFront endpoint for a static site and the scan fails for this as well.
If anyone is familiar with this plugin and/or can assist with how to overcome this vulnerability (as flagged by this plugin) w/o disabling HTTP/1.1 (which really isn't an option at this time) would be very much appreciated as we are stuck, and imminently facing missing our quarterly ASV. I've read the article attached to the plugin's landing page but the scan seems overbroad vs. the actual vulnerability described in the article.