CVE-2020-11653 – varnish: remote clients may cause Varnish to assert and restart which could result in DoS

https://notcve.org/view.php?id=CVE-2020-11653

An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss. Se detectó un problema en Varnish Cache versiones anteriores a 6.0.6 LTS, versiones 6.1.x y versiones 6.2.x anteriores a 6.2.3 y versiones 6.3.x anteriores a 6.3.2. Se presenta cuando la comunicación con un proxy de terminación TLS usa PROXY versión 2. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html https://varnish-cache.org/security/VSV00005.html#vsv00005 https://access.redhat.com/security/cve/CVE-2020-11653 https://bugzilla.redhat.com/show_bug.cgi?id=1813867 • CWE-400: Uncontrolled Resource Consumption CWE-617: Reachable Assertion •