PT-2024-40372 · Varnish+1 · Varnish+1

Published 2024-12-02 · Updated 2024-12-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ezplatform-http-cache (affected versions not specified)

Description The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to included Varnish VCL templates that enable compression of API and JSON messages. To mitigate this, it is recommended to disable compression in these templates and check web server configurations.

Recommendations Disable HTTP compression for REST API requests and other communication that might contain secrets. Make sure to make the same change in your configuration files, following the specific instructions in the release notes. Check your web server configuration to ensure HTTP compression is disabled for sensitive communications.

Related Identifiers

GHSA-MGFG-7533-7JF6

Affected Products

Varnish

Ezplatform-Http-Cache

References · 9

• https://osv.dev/vulnerability/GHSA-mgfg-7533-7jf6 · Vendor Advisory
• https://github.com/ezsystems/ezplatform-http-cache · Note
• https://github.com/ezsystems/ezplatform-http-cache/commit/ca8a5cf69b2c14fbec90412aeeef5c755c51457b · Note
• https://github.com/ezsystems/ezplatform-http-cache/security/advisories/GHSA-mgfg-7533-7jf6 · Note
• https://github.com/ibexa/post-install/security/advisories/GHSA-4h8f-c635-25p7 · Note
• https://github.com/ibexa/http-cache/security/advisories/GHSA-fh7v-q458-7vmw · Note
• https://doc.ibexa.co/en/latest/update_and_migration/from_3.3/update_from_3.3/#v3341 · Note
• https://breachattack.com · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates · Note