CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-11653 – varnish: remote clients may cause Varnish to assert and restart which could result in DoS
https://notcve.org/view.php?id=CVE-2020-11653
An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss. Se detectó un problema en Varnish Cache versiones anteriores a 6.0.6 LTS, versiones 6.1.x y versiones 6.2.x anteriores a 6.2.3 y versiones 6.3.x anteriores a 6.3.2. Se presenta cuando la comunicación con un proxy de terminación TLS usa PROXY versión 2. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html https://varnish-cache.org/security/VSV00005.html#vsv00005 https://access.redhat.com/security/cve/CVE-2020-11653 https://bugzilla.redhat.com/show_bug.cgi?id=1813867 • CWE-400: Uncontrolled Resource Consumption CWE-617: Reachable Assertion •
CVSS: 7.8EPSS: 4%CPEs: 4EXPL: 0CVE-2019-15892 – varnish: denial of service handling certain crafted HTTP/1 requests
https://notcve.org/view.php?id=CVE-2019-15892
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack. Se detecto un problema en Varnish Cache en versiones anteriores a la 6.0.4 LTS y 6.1.x y 6.2.x en versiones anteriores a la 6.2.1. Un error de análisis HTTP/1 permite a un atacante remoto desencadenar una aserción mediante el envío de solicitudes HTTP/1 diseñadas. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00069.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00089.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3OEOCYRU43TWEU2C65F3D6GK64MSWNNK https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBAQF6UDRSTURGINIMSMLJR4PTDYWA7C https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLSF54TDJWJLINIFEW5V5BKDNY5EQRR3 https://seclists.org/b • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •