An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0024 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-15892:
    An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1     parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The     assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

    CVE-2019-20637:
    An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before     6.3.1. It does not clear a pointer between the handling of one client request and the next request within     the same connection. This sometimes causes information to be disclosed from the connection workspace, such     as data structures associated with previous requests within this connection or VCL-related temporary     headers.

    CVE-2022-23959:
    In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish     Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for     HTTP/1 connections.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4756 advisory.

  - An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1     parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The     assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
    (CVE-2019-15892)

  - An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before     6.3.1. It does not clear a pointer between the handling of one client request and the next request within     the same connection. This sometimes causes information to be disclosed from the connection workspace, such     as data structures associated with previous requests within this connection or VCL-related temporary     headers. (CVE-2019-20637)

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4756 advisory.

  - varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

  - varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)

  - varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4756 advisory.

    - Resolves: #1790907 - CVE-2019-20637 varnish: not clearing pointer between two       client requests leads to information disclosure
    - Resolves: #1763958 - CVE-2019-15892 varnish:6/varnish: denial of service       handling certain crafted HTTP/1 requests

    varnish-modules

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4756 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    The following packages have been upgraded to a later upstream version: varnish (6.0.6). (BZ#1795673)

    Security Fix(es):

    * varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

    * varnish: remote clients may cause Varnish to assert and restart which could result in DoS     (CVE-2020-11653)

    * varnish: not clearing pointer between two client requests leads to information disclosure     (CVE-2019-20637)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New upstream release. A security release, patching VSV00003 DoS attack vector, aka CVE-2019-15892.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release. A security release, fixing VSV00003, CVE-2019-15892. For a list of other changes, please see the upstream changelog at https://github.com/varnishcache/varnish-cache/blob/6.0/doc/changes.rst

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for varnish fixes the following issues :

Security issue fixed :

  - CVE-2019-15892: Fixed a potential denial of service by     sending crafted HTTP/1 requests (boo#1149382).

Non-security issues fixed :

&#9; - Updated the package to release 6.2.1.

  - Added a thread pool watchdog which will restart the     worker process if scheduling tasks onto worker threads     appears stuck. The new parameter 'thread_pool_watchdog'     configures it.

  - Disabled error for clobbering, which caused bogus error     in varnishtest.

Alf-Andre Walla discovered a remotely triggerable assert in the Varnish web accelerator; sending a malformed HTTP request could result in denial of service.

The oldstable distribution (stretch) is not affected.

ID	Name	Product	Family	Severity
236666	Alibaba Cloud Linux 3 : 0024: varnish:6 (ALINUX3-SA-2022:0024)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
184825	Rocky Linux 8 : varnish:6 (RLSA-2020:4756)	Nessus	Rocky Linux Local Security Checks	high
145911	CentOS 8 : varnish:6 (CESA-2020:4756)	Nessus	CentOS Local Security Checks	high
142772	Oracle Linux 8 : varnish:6 (ELSA-2020-4756)	Nessus	Oracle Linux Local Security Checks	high
142443	RHEL 8 : varnish:6 (RHSA-2020:4756)	Nessus	Red Hat Local Security Checks	high
129659	Fedora 30 : varnish (2019-feec5e0afd)	Nessus	Fedora Local Security Checks	high
129638	Fedora 31 : varnish (2019-a0a0cdef92)	Nessus	Fedora Local Security Checks	high
129421	Fedora 29 : varnish (2019-8a85a90af6)	Nessus	Fedora Local Security Checks	high
129376	openSUSE Security Update : varnish (openSUSE-2019-2184)	Nessus	SuSE Local Security Checks	high
128510	Debian DSA-4514-1 : varnish - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-15892

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high