PT-2016-4045 · Varnish · Varnish

Regilero + 1 · Published 2016-04-21 · Updated 2022-08-02 · CVE-2015-8852

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Varnish versions 3.x through 3.0.6

Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request. This occurs when Varnish is used in certain stacked installations.

Recommendations For Varnish versions 3.x through 3.0.6, update to version 3.0.7 or later to resolve the issue.

Fix

Related Identifiers

CVE-2015-8852

DSA-3553-1

MGASA-2016-0150

Affected Products

Varnish

References · 26

• https://debian.org/security/2016/dsa-3553 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8852 · Security Note
• https://ubuntu.com/security/CVE-2015-8852 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0150 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8852 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00064.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0150.html · Security Note
• https://security-tracker.debian.org/tracker/source-package/varnish · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8852 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3553-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8852 · Vendor Advisory
• http://debian.org/security/2016/dsa-3553 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8852 · Vendor Advisory
• https://security.gentoo.org/glsa/201607-10 · Vendor Advisory
• https://varnish-cache.org/lists/pipermail/varnish-announce/2015-March/000701.html · Vendor Advisory