PT-2023-27789 · Varnish · Varnish Enterprise+1

Published 2023-08-23 · Updated 2023-08-28 · CVE-2023-41104

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions libvmod-digest versions prior to 1.0.3 Varnish Enterprise versions 6.0.x prior to 6.0.11r5

Description The issue is caused by an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure. The exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.

Recommendations For libvmod-digest versions prior to 1.0.3, update to version 1.0.3 or later. For Varnish Enterprise versions 6.0.x prior to 6.0.11r5, update to version 6.0.11r5 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2023-41104

Affected Products

Varnish Enterprise

Libvmod-Digest

References · 7

• https://osv.dev/vulnerability/CVE-2023-41104 · Vendor Advisory
• https://varnish-cache.org/security/VSV00012.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41104 · Security Note
• https://docs.varnish-software.com/security/VSV00012 · Vendor Advisory
• https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3 · Note
• https://t.me/cibsecurity/69047 · Telegram Post
• https://t.me/cvenotify/57144 · Telegram Post