Reachable Assertion Affecting varnish-modules package, versions <0:0.15.0-5.module+el8.3.0+7653+45014445


medium

Snyk CVSS

    Attack Complexity Low
    Availability High

    Threat Intelligence

    EPSS 3.92% (92nd percentile)
Expand this section
NVD
7.5 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-ORACLE8-VARNISHMODULES-2574677
  • published 10 Apr 2022
  • disclosed 3 Sep 2019

How to fix?

Upgrade Oracle:8 varnish-modules to version 0:0.15.0-5.module+el8.3.0+7653+45014445 or higher.
This issue was patched in ELSA-2020-4756.

NVD Description

Note: Versions mentioned in the description apply only to the upstream varnish-modules package and not the varnish-modules package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.