CVSS: 7.8EPSS: 4%CPEs: 4EXPL: 0CVE-2019-15892 – varnish: denial of service handling certain crafted HTTP/1 requests
https://notcve.org/view.php?id=CVE-2019-15892
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack. Se detecto un problema en Varnish Cache en versiones anteriores a la 6.0.4 LTS y 6.1.x y 6.2.x en versiones anteriores a la 6.2.1. Un error de análisis HTTP/1 permite a un atacante remoto desencadenar una aserción mediante el envío de solicitudes HTTP/1 diseñadas. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00069.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00089.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3OEOCYRU43TWEU2C65F3D6GK64MSWNNK https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBAQF6UDRSTURGINIMSMLJR4PTDYWA7C https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLSF54TDJWJLINIFEW5V5BKDNY5EQRR3 https://seclists.org/b • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 9.1EPSS: 1%CPEs: 3EXPL: 0CVE-2017-8807
https://notcve.org/view.php?id=CVE-2017-8807
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects. vbf_stp_error en bin/varnishd/cache/cache_fetch.c en Varnish HTTP Cache en versiones 4.1.x anteriores a la 4.1.9 y las versiones 5.x anteriores a la 5.2.1 permite que atacantes remotos obtengan información sensible de la memoria de procesos debido a que un búfer VFP_GetStorage es más grande de lo planeado en ciertas circunstancias relacionadas con objetos transitorios -sfile Stevedore. • http://varnish-cache.org/security/VSV00002.html http://www.securityfocus.com/bid/101886 https://bugs.debian.org/881808 https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7 https://github.com/varnishcache/varnish-cache/pull/2429 https://www.debian.org/security/2017/dsa-4034 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 34EXPL: 0CVE-2017-12425
https://notcve.org/view.php?id=CVE-2017-12425
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases. • http://www.debian.org/security/2017/dsa-3924 https://bugzilla.redhat.com/show_bug.cgi?id=1477222 https://bugzilla.suse.com/show_bug.cgi?id=1051917 https://github.com/varnishcache/varnish-cache/issues/2379 https://lists.debian.org/debian-security-announce/2017/msg00186.html https://www.varnish-cache.org/security/VSV00001.html#vsv00001 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2015-8852
https://notcve.org/view.php?id=CVE-2015-8852
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request. Varnish 3.x en versiones anteriores a 3.0.7, cuando se utiliza en ciertas instalaciones apiladas, permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de separación de respuesta HTTP a través de una línea de cabecera terminada por un carácter \r (retorno de carro) en conjunción con múltiples cabeceras Content-Length en una petición HTTP. • http://lists.opensuse.org/opensuse-updates/2016-05/msg00064.html http://www.debian.org/security/2016/dsa-3553 http://www.openwall.com/lists/oss-security/2016/04/16/1 http://www.openwall.com/lists/oss-security/2016/04/18/7 https://github.com/varnish/Varnish-Cache/commit/29870c8fe95e4e8a672f6f28c5fbe692bea09e9c https://github.com/varnish/Varnish-Cache/commit/85e8468bec9416bd7e16b0d80cb820ecd2b330c3 https://security.gentoo.org/glsa/201607-10 https://www.varnish-cache.org/lists/pipermail/varnish-announce •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-0345
https://notcve.org/view.php?id=CVE-2013-0345
varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files. NOTE: some of these details are obtained from third party information. varnish 3.0.3 utiliza permisos de lectura universal para el directorio /var/log/varnish/ y los archivos del registro en el directorio, lo que permite a usuarios locales obtener información sensible mediante la lectura de los archivos. NOTA: algunos de estos detalles se obtienen de información de terceras partes. • http://www.openwall.com/lists/oss-security/2013/02/22/14 http://www.openwall.com/lists/oss-security/2013/02/23/4 http://www.osvdb.org/90586 http://www.securityfocus.com/bid/58125 • CWE-264: Permissions, Privileges, and Access Controls •