PT-2019-3468 · Varnish+4 · Varnish Cache+4

Alf-Andre Walla · Publicado 2019-09-03 · Atualizado 2026-05-11 · CVE-2019-15892

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Varnish Cache versions prior to 6.0.4 LTS Varnish Cache versions 6.1.x through 6.2.0

Description An issue in Varnish Cache allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests, causing an automatic restart with a clean cache and resulting in a Denial of Service attack. The issue is due to insufficient input validation in the HTTP/1 parser.

Recommendations For Varnish Cache versions prior to 6.0.4 LTS, update to version 6.0.4 LTS or later. For Varnish Cache versions 6.1.x through 6.2.0, update to version 6.2.1 or later. As a temporary workaround, consider restricting access to the HTTP/1 parser to minimize the risk of exploitation.

Correção

DoS

RCE

Assertion Failure

Enumeração de Fraquezas

CWE-20

CWE-617

Identificadores relacionados

BDU:2019-03642

CESA-2020_4756

CVE-2019-15892

DSA-4514-1

OESA-2021-1032

OPENSUSE-SU-2019:2184-1

OPENSUSE-SU-2019:2221-1

OPENSUSE-SU-2019_2184-1

OPENSUSE-SU-2024:11493-1

OPENSUSE-SU-2026:10751-1

RHSA-2020:4756

RHSA-2020_4756

RLSA-2020:4756

Produtos afetados

Centos

Red Hat

Rocky Linux

Suse

Varnish Cache

Referências · 58

• https://github.com/varnishcache/varnish-cache/commit/dd47e658a0de9d12c433a4a01fb43ea4fe4d3a41 · Nota
• https://github.com/varnishcache/varnish-cache/commit/72df38fa8bfc0f5ca4a75d3e32657e8e590d85ab · Nota
• https://github.com/varnishcache/varnish-cache/commit/1cb778f6f69737109e8c070a74b8e95b78f46d13 · Nota
• https://github.com/varnishcache/varnish-cache/commit/0f0e51e9871ed1bd1236378f8b0dea0d33df4e9e · Nota
• https://github.com/varnishcache/varnish-cache/commit/34717183beda3803e3d54c9826a1a9f026ca2505 · Nota
• https://github.com/varnishcache/varnish-cache/commit/af13de03eaa3d04f60ada52ed3235d545b8d3973 · Nota
• https://github.com/varnishcache/varnish-cache/commit/6da64a47beff44ecdb45c82b033811f2d19819af · Nota
• https://github.com/varnishcache/varnish-cache/commit/ec3997a59a93cbc13a3cba22dfe0b4c4710a8f65 · Nota
• https://linux.oracle.com/errata/ELSA-2020-4756.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2022-45060 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/AWPBCC3MHKJATBZQOOYCIA3GVIFCGWDK/#AWPBCC3MHKJATBZQOOYCIA3GVIFCGWDK · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/EUILTBTXVXCNRCSBNVQOFYGAQZGHOI3D/#EUILTBTXVXCNRCSBNVQOFYGAQZGHOI3D · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00089.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15892 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2026:10751-1 · Aviso do Fabricante