SB2021082538 - Anolis OS update for varnish:6 (Anolis OS 8.4) module

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2021-36740)

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/2 requests. A remote attacker can send a specially crafted HTTP/2 POST request with a large Content-Length header to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache or bypass VCL authorization.

2) Reachable Assertion (CVE-ID: CVE-2019-15892)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when parsing HTTP/1 requests. A remote attacker can send specially crafted HTTP/1 requests to the affected server and trigger application restart, resulting in a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2021:0061