Homepage

NULL Pointer Dereference The advisory has been revoked - it doesn't affect any version of package varnish-modules  (opens in a new tab)

Threat Intelligence

EPSS
1.5% (71st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN9-VARNISHMODULES-1086520
  • published17 Mar 2021
  • disclosed16 Mar 2021
Report a new vulnerability Found a mistake?

Introduced: 16 Mar 2021

CVE-2021-28543  (opens in a new tab)
CWE-476  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream varnish-modules package and not the varnish-modules package as distributed by Debian.

Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to install both Varnish Cache and varnish-modules. Specifically, an assertion failure or NULL pointer dereference can be triggered in Varnish Cache through the varnish-modules header.append() and header.copy() functions. For some Varnish Configuration Language (VCL) files, this gives remote clients an opportunity to cause a Varnish Cache restart. A restart reduces overall availability and performance due to an increased number of cache misses, and may cause higher load on backend servers.