Reachable Assertion Affecting varnish package, versions <6.2.1-1


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
4.24% (93rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-VARNISH-528971
  • published3 Sept 2019
  • disclosed3 Sept 2019

Introduced: 3 Sep 2019

CVE-2019-15892  (opens in a new tab)
CWE-617  (opens in a new tab)

How to fix?

Upgrade Debian:11 varnish to version 6.2.1-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream varnish package and not the varnish package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.