PT-2016-4045 · Varnish · Varnish

Regilero + 1 · Publicado 2016-04-21 · Atualizado 2022-08-02 · CVE-2015-8852

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Varnish versions 3.x through 3.0.6

Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request. This occurs when Varnish is used in certain stacked installations.

Recommendations For Varnish versions 3.x through 3.0.6, update to version 3.0.7 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2015-8852

DSA-3553-1

MGASA-2016-0150

Produtos afetados

Varnish

Referências · 26

• https://github.com/varnish/Varnish-Cache/commit/85e8468bec9416bd7e16b0d80cb820ecd2b330c3 · Nota
• https://github.com/varnish/Varnish-Cache/commit/29870c8fe95e4e8a672f6f28c5fbe692bea09e9c · Nota
• https://debian.org/security/2016/dsa-3553 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8852 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-8852 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2016-0150 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=18244 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8852 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00064.html · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2016-0150.html · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/varnish · Aviso do Fabricante
• https://t.me/cvenotify/34159 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2015-8852 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3553-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/04/16/1 · Nota