PT-2021-17876 · Varnish · Varnish Cache+1

Nils Goroll · Published 2021-03-16 · Updated 2021-03-26 · CVE-2021-28543

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Varnish varnish-modules versions prior to 0.17.1

Description: The issue allows remote attackers to cause a denial of service (daemon restart) in some configurations, specifically when both Varnish Cache and varnish-modules are installed. This can be triggered through the varnish-modules header.append() and header.copy() functions, potentially causing a Varnish Cache restart for some Varnish Configuration Language (VCL) files. A restart reduces overall availability and performance due to an increased number of cache misses and may cause higher load on backend servers.

Recommendations: For versions prior to 0.17.1, update to version 0.17.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the header.append() and header.copy() functions in varnish-modules to minimize the risk of exploitation.

Fix

DoS

Assertion Failure

NULL Pointer Dereference

Weakness Enumeration

CWE-617

CWE-476

Related Identifiers

CVE-2021-28543

Affected Products

Varnish Cache

Varnish-Modules

References · 6

• https://osv.dev/vulnerability/CVE-2021-28543 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPFBRQUJNWHCB3GQHSSAPRLQU6Q6PY43 · Vendor Advisory
• https://varnish-cache.org/security/VSV00006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28543 · Security Note
• https://t.me/cibsecurity/24950 · Telegram Post
• https://t.me/cvenotify/11689 · Telegram Post