An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0024 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-15892:
    An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1     parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The     assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

    CVE-2019-20637:
    An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before     6.3.1. It does not clear a pointer between the handling of one client request and the next request within     the same connection. This sometimes causes information to be disclosed from the connection workspace, such     as data structures associated with previous requests within this connection or VCL-related temporary     headers.

    CVE-2022-23959:
    In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish     Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for     HTTP/1 connections.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4756 advisory.

  - An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1     parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The     assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
    (CVE-2019-15892)

  - An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before     6.3.1. It does not clear a pointer between the handling of one client request and the next request within     the same connection. This sometimes causes information to be disclosed from the connection workspace, such     as data structures associated with previous requests within this connection or VCL-related temporary     headers. (CVE-2019-20637)

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5474-1 advisory.

    It was dicovered that Varnish Cache did not clear a pointer between the handling of one client request and     the next request within the same connection. A remote attacker could possibly use this issue to obtain     sensitive information. (CVE-2019-20637)

    It was discovered that Varnish Cache could have an assertion failure when a TLS termination proxy uses     PROXY version 2. A remote attacker could possibly use this issue to restart the daemon and cause a     performance loss. (CVE-2020-11653)

    It was discovered that Varnish Cache allowed request smuggling and VCL authorization bypass via a large     Content-Length header for a POST request. A remote attacker could possibly use this issue to obtain     sensitive information. (CVE-2021-36740)

    It was discovered that Varnish Cache allowed request smuggling for HTTP/1 connections. A remote attacker     could possibly use this issue to obtain sensitive information. (CVE-2022-23959)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4756 advisory.

  - varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

  - varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)

  - varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4756 advisory.

    - Resolves: #1790907 - CVE-2019-20637 varnish: not clearing pointer between two       client requests leads to information disclosure
    - Resolves: #1763958 - CVE-2019-15892 varnish:6/varnish: denial of service       handling certain crafted HTTP/1 requests

    varnish-modules

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4756 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    The following packages have been upgraded to a later upstream version: varnish (6.0.6). (BZ#1795673)

    Security Fix(es):

    * varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

    * varnish: remote clients may cause Varnish to assert and restart which could result in DoS     (CVE-2020-11653)

    * varnish: not clearing pointer between two client requests leads to information disclosure     (CVE-2019-20637)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for varnish fixes the following issues :

  - CVE-2019-20637: Fixed an information leak when handling     one client request and the next on the same connection     (boo#1169040)

  - CVE-2020-11653: Fixed a performance loss due to an     assertion failure and daemon restart when communicating     with TLS termination proxy that uses PROXY version 2     (boo#1169039)

ID	Name	Product	Family	Severity
236666	Alibaba Cloud Linux 3 : 0024: varnish:6 (ALINUX3-SA-2022:0024)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
184825	Rocky Linux 8 : varnish:6 (RLSA-2020:4756)	Nessus	Rocky Linux Local Security Checks	high
161982	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Varnish Cache vulnerabilities (USN-5474-1)	Nessus	Ubuntu Local Security Checks	critical
145911	CentOS 8 : varnish:6 (CESA-2020:4756)	Nessus	CentOS Local Security Checks	high
142772	Oracle Linux 8 : varnish:6 (ELSA-2020-4756)	Nessus	Oracle Linux Local Security Checks	high
142443	RHEL 8 : varnish:6 (RHSA-2020:4756)	Nessus	Red Hat Local Security Checks	high
138686	openSUSE Security Update : varnish (openSUSE-2020-808)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-20637

high

Tenable Plugins

critical

high

critical

high

high

high

high