Reachable Assertion in Varnish Cache - CVE-2019-15892

Vulnerability identifier: #VU20863

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15892

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when parsing HTTP/1 requests. A remote attacker can send specially crafted HTTP/1 requests to the affected server and trigger application restart, resulting in a denial of service (DoS) attack.

Varnish Cache
Red Hat Software Collections
varnish (Alpine package)
varnish (Debian package)
varnish-modules
rh-varnish6-varnish-modules (Red Hat package)
rh-varnish6 (Red Hat package)
varnish-help
varnish
varnish-debuginfo
varnish-debugsource
varnish-devel
rh-varnish6-varnish (Red Hat package)
varnish-docs
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
SUSE Linux
Opensuse
openEuler
Fedora

Install updates from vendor's website.

Varnish Cache - addressed in versions 6.0.4, 6.2.1
varnish (Alpine package) - update to 6.0.4-r0
varnish (Debian package) - update to 6.1.1-1+deb10u1
varnish-modules - update to 0.15.0-5
rh-varnish6-varnish-modules (Red Hat package) - update to 0.15.0-6.el7
rh-varnish6 (Red Hat package) - update to 4.1-6.el7
varnish-help - update to 6.0.0-5
varnish - update to 6.0.0-5
varnish-debuginfo - update to 6.0.0-5
varnish-debugsource - update to 6.0.0-5
varnish-devel - update to 6.0.0-5
varnish - addressed in versions 6.0.4-3.fc29, 6.3.0-1.fc30, 6.3.0-1.fc31
rh-varnish6-varnish (Red Hat package) - update to 6.0.6-1.el7
varnish - update to 6.0.6-2
varnish-devel - update to 6.0.6-2
varnish-docs - update to 6.0.6-2

• https://varnish-cache.org/security/VSV00003.html

• Denial of service in Varnish Cache
• Debian update for varnish
• OpenSUSE Linux update for varnish
• OpenSUSE Linux update for varnish
• Reachable Assertion in varnish (Alpine package)
• Red Hat Enterprise Linux 8 update for the varnish:6 module
• Red Hat Software Collections update for varnish
• openEuler update for varnish
• Anolis OS update for varnish:6 (Anolis OS 8.4) module
• Fedora 29 update for varnish
• Fedora 30 update for varnish
• Fedora 31 update for varnish