Reachable Assertion Affecting varnish-modules package, versions <0:0.15.0-5.module+el8.3.0+7653+45014445
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE8-VARNISHMODULES-2574677
- published 10 Apr 2022
- disclosed 3 Sep 2019
Introduced: 3 Sep 2019
CVE-2019-15892 Open this link in a new tabHow to fix?
Upgrade Oracle:8
varnish-modules
to version 0:0.15.0-5.module+el8.3.0+7653+45014445 or higher.
This issue was patched in ELSA-2020-4756
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream varnish-modules
package and not the varnish-modules
package as distributed by Oracle
.
See How to fix?
for Oracle:8
relevant fixed versions and status.
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.