PT-2024-40272 · Ibexa+1 · Ibexa/Http-Cache+1

Published 2024-12-02 · Updated 2024-12-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: ibexa/http-cache (affected versions not specified)

Description: The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to included Varnish VCL templates that enable compression of API and JSON messages. To mitigate this, it is recommended to disable compression in these templates and check web server configurations.

Recommendations: Disable HTTP compression for REST API requests and other communication that might contain secrets. Make sure to make the same change in your configuration files, following the specific instructions in the release notes. Check your web server configuration to ensure HTTP compression is disabled for sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-FH7V-Q458-7VMW

Affected Products

Varnish

Ibexa/Http-Cache

References · 9

• https://osv.dev/vulnerability/GHSA-fh7v-q458-7vmw · Vendor Advisory
• https://github.com/ezsystems/ezplatform-http-cache/security/advisories/GHSA-mgfg-7533-7jf6 · Note
• https://github.com/ibexa/post-install/security/advisories/GHSA-4h8f-c635-25p7 · Note
• https://github.com/ibexa/http-cache/security/advisories/GHSA-fh7v-q458-7vmw · Note
• https://github.com/ibexa/http-cache/commit/e03f683e8db53b6d253e1af8177befeecc8d3914 · Note
• https://github.com/ibexa/http-cache · Note
• https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614 · Note
• https://breachattack.com · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates · Note