PT-2020-22796 · Varnish · Varnish Cache

Published 2020-04-02 · Updated 2020-04-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Varnish Cache (affected versions not specified)

Description The issue occurs when Varnish Cache is used with a TLS termination proxy and both the proxy and Varnish use the PROXY version 2 protocol. This can trigger an assert in Varnish Cache, causing it to restart. As a result, the cache will be empty after the restart.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2020-0154

Affected Products

Varnish Cache

References · 5

• https://advisories.mageia.org/MGASA-2020-0154.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/FWJNWSLEZGPJBSBKJBLCPFOAO36PCZ7N · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0154 · Vendor Advisory
• https://varnish-cache.org/security/VSV00005.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=26404 · Note