CVE-2019-15892
Fixed in a distro release EPSS 6%
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
Products: varnish-software varnish_cache, varnish_cache_project varnish_cache, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | varnish | 6.2.1-r0 |
| Alpine 3.11 | varnish | 6.2.1-r0 |
| Alpine 3.12 | varnish | 6.2.1-r0 |
| Alpine 3.13 | varnish | 6.2.1-r0 |
| Alpine 3.14 | varnish | 6.2.1-r0 |
| Alpine 3.15 | varnish | 6.2.1-r0 |
| Alpine 3.16 | varnish | 6.2.1-r0 |
| Alpine 3.17 | varnish | 6.2.1-r0 |
| Alpine 3.18 | varnish | 6.2.1-r0 |
| Alpine 3.19 | varnish | 6.2.1-r0 |
| Alpine 3.20 | varnish | 6.2.1-r0 |
| Alpine 3.21 | varnish | 6.2.1-r0 |
| Alpine 3.22 | varnish | 6.2.1-r0 |
| Alpine 3.23 | varnish | 6.2.1-r0 |
| Alpine 3.24 | varnish | 6.2.1-r0 |
| Alpine 3.8 | varnish | 6.0.4-r0 |
| Alpine 3.9 | varnish | 6.2.1-r0 |
| Debian 10 | varnish | 6.1.1-1+deb10u1 |
| Debian 12 | varnish | 6.2.1-1 |
| Debian 13 | varnish | 6.2.1-1 |
| Red Hat Enterprise Linux 8 | varnish | 0:6.0.6-2.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-devel | 0:6.0.6-2.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-docs | 0:6.0.6-2.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-modules | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-modules-debuginfo | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-modules-debugsource | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Red Hat rhel software collections 3 | rh-varnish6 | 0:4.1-6.el7 |
| Red Hat rhel software collections 3 | rh-varnish6-runtime | 0:4.1-6.el7 |
| Red Hat rhel software collections 3 | rh-varnish6-scldevel | 0:4.1-6.el7 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish | 0:6.0.6-1.el7 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish-devel | 0:6.0.6-1.el7 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish-docs | 0:6.0.6-1.el7 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish-libs | 0:6.0.6-1.el7 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish-modules | 0:0.15.0-6.el7 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish-modules-debuginfo | 0:0.15.0-6.el7 |
| Rocky Linux 8 | varnish | 0:6.0.6-2.module+el8.3.0+179+20b582cc |
| Rocky Linux 8 | varnish-modules | 0:0.15.0-5.module+el8.3.0+179+20b582cc |
| SUSE Package Hub 15 | varnish | 6.2.1-bp151.4.3.1 |
| SUSE Package Hub 15 SP1 | varnish | 6.2.1-bp151.4.3.1 |
| openSUSE Leap 15.0 | varnish | 6.2.1-lp151.3.3.1 |
| openSUSE Leap 15.1 | varnish | 6.2.1-lp151.3.3.1 |
| openSUSE Tumbleweed | varnish | 6.6.1-1.2 |
| openSUSE Tumbleweed | vinyl-cache | 9.0.0-1.1 |