PT-2020-12751 · Varnish+6 · Varnish Cache+6

Martin Van Kervel Smedshammer · Published 2020-04-08 · Updated 2022-11-29 · CVE-2020-11653

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Varnish Cache versions prior to 6.0.6 LTS Varnish Cache versions 6.1.x Varnish Cache versions 6.2.x prior to 6.2.3 Varnish Cache versions 6.3.x prior to 6.3.2

Description An issue occurs in Varnish Cache when communication with a TLS termination proxy uses PROXY version 2, leading to an assertion failure and daemon restart. This results in a performance loss.

Recommendations For versions prior to 6.0.6 LTS, update to version 6.0.6 LTS or later. For versions 6.1.x, update to version 6.2.3 or later. For versions 6.2.x prior to 6.2.3, update to version 6.2.3 or later. For versions 6.3.x prior to 6.3.2, update to version 6.3.2 or later.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CESA-2020_4756

CVE-2020-11653

DLA-3208-1

OPENSUSE-SU-2020:0808-1

OPENSUSE-SU-2020:0819-1

OPENSUSE-SU-2020_0808-1

RHSA-2020:4756

RHSA-2020_4756

RLSA-2020:4756

USN-5474-1

USN-5474-2

Affected Products

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Varnish Cache

References · 37

• https://varnish-cache.org/security/VSV00005.html#vsv00005 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11653 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20637 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11653 · Security Note
• https://ubuntu.com/security/notices/USN-5474-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5474-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4756.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0819-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11653 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3208-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2020:4756 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11653 · Security Note
• https://errata.rockylinux.org/RLSA-2020:4756 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11653 · Vendor Advisory