An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4756 advisory.

  - An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1     parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The     assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
    (CVE-2019-15892)

  - An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before     6.3.1. It does not clear a pointer between the handling of one client request and the next request within     the same connection. This sometimes causes information to be disclosed from the connection workspace, such     as data structures associated with previous requests within this connection or VCL-related temporary     headers. (CVE-2019-20637)

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3208 advisory.

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5474-2 advisory.

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 21.10 / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5474-1 advisory.

  - An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before     6.3.1. It does not clear a pointer between the handling of one client request and the next request within     the same connection. This sometimes causes information to be disclosed from the connection workspace, such     as data structures associated with previous requests within this connection or VCL-related temporary     headers. (CVE-2019-20637)

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

  - Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large     Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and     Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8. (CVE-2021-36740)

  - In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish     Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for     HTTP/1 connections. (CVE-2022-23959)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4756 advisory.

  - varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

  - varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)

  - varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4756 advisory.

  - An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1     parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The     assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
    (CVE-2019-15892)

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

  - An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before     6.3.1. It does not clear a pointer between the handling of one client request and the next request within     the same connection. This sometimes causes information to be disclosed from the connection workspace, such     as data structures associated with previous requests within this connection or VCL-related temporary     headers. (CVE-2019-20637)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4756 advisory.

  - varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

  - varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)

  - varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for varnish fixes the following issues :

  - CVE-2019-20637: Fixed an information leak when handling     one client request and the next on the same connection     (boo#1169040)

  - CVE-2020-11653: Fixed a performance loss due to an     assertion failure and daemon restart when communicating     with TLS termination proxy that uses PROXY version 2     (boo#1169039)

ID	Name	Product	Family	Severity
184825	Rocky Linux 8 : varnish:6 (RLSA-2020:4756)	Nessus	Rocky Linux Local Security Checks	high
168207	Debian DLA-3208-1 : varnish - LTS security update	Nessus	Debian Local Security Checks	high
164377	Ubuntu 20.04 LTS : Varnish Cache regression (USN-5474-2)	Nessus	Ubuntu Local Security Checks	high
161982	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Varnish Cache vulnerabilities (USN-5474-1)	Nessus	Ubuntu Local Security Checks	critical
145911	CentOS 8 : varnish:6 (CESA-2020:4756)	Nessus	CentOS Local Security Checks	high
142772	Oracle Linux 8 : varnish:6 (ELSA-2020-4756)	Nessus	Oracle Linux Local Security Checks	high
142443	RHEL 8 : varnish:6 (RHSA-2020:4756)	Nessus	Red Hat Local Security Checks	high
138686	openSUSE Security Update : varnish (openSUSE-2020-808)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-11653

high

Tenable Plugins

high

high

high

critical

high

high

high

high