CVE-2015-8852 Affecting varnish package, versions <4.0.0-1


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.82% (83rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-VARNISH-531424
  • published25 Apr 2016
  • disclosed25 Apr 2016

Introduced: 25 Apr 2016

CVE-2015-8852  (opens in a new tab)

How to fix?

Upgrade Debian:11 varnish to version 4.0.0-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream varnish package and not the varnish package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.

CVSS Scores

version 3.1