CVSS: 7.8EPSS: 5%CPEs: 4EXPL: 0CVE-2019-15892 – varnish: denial of service handling certain crafted HTTP/1 requests
https://notcve.org/view.php?id=CVE-2019-15892
03 Sep 2019 — An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack. Se detecto un problema en Varnish Cache en versiones anteriores a la 6.0.4 LTS y 6.1.x y 6.2.x en versiones anteriores a la 6.2.1. Un error de análisis HTTP/1 permite a un atacante remoto desencadenar una ... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00069.html • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 9.1EPSS: 1%CPEs: 3EXPL: 0CVE-2017-8807
https://notcve.org/view.php?id=CVE-2017-8807
16 Nov 2017 — vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects. vbf_stp_error en bin/varnishd/cache/cache_fetch.c en Varnish HTTP Cache en versiones 4.1.x anteriores a la 4.1.9 y las versiones 5.x anteriores a la 5.2.1 permite que atacantes remotos obtengan inf... • http://varnish-cache.org/security/VSV00002.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 34EXPL: 0CVE-2017-12425
https://notcve.org/view.php?id=CVE-2017-12425
04 Aug 2017 — An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of... • http://www.debian.org/security/2017/dsa-3924 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2015-8852 – Debian Security Advisory 3553-1
https://notcve.org/view.php?id=CVE-2015-8852
22 Apr 2016 — Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request. Varnish 3.x en versiones anteriores a 3.0.7, cuando se utiliza en ciertas instalaciones apiladas, permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de separación de r... • http://lists.opensuse.org/opensuse-updates/2016-05/msg00064.html •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2013-0345 – Gentoo Linux Security Advisory 201412-30
https://notcve.org/view.php?id=CVE-2013-0345
08 May 2014 — varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files. NOTE: some of these details are obtained from third party information. varnish 3.0.3 utiliza permisos de lectura universal para el directorio /var/log/varnish/ y los archivos del registro en el directorio, lo que permite a usuarios locales obtener información sensible mediante la lectura de los archivos. NOTA: alg... • http://www.openwall.com/lists/oss-security/2013/02/22/14 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 20EXPL: 2CVE-2013-4484 – Varnish Cache Denial of Service
https://notcve.org/view.php?id=CVE-2013-4484
31 Oct 2013 — Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI. Vulnerablilidad en Varnish antes de 3.0.5 permite a atacantes remotos provocar una denegación de servicio (caída del proceso hijo y corte de caché temporal) a través de una solicitud GET con espacios en blanco finales y sin URI. If Varnish receives a certain illegal request, and the subroutine 'vcl_error{}' restarts the... • https://packetstorm.news/files/id/123867 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •