CVE-2019-15892 — Reachable Assertion in Varnish Cache

CWE-617 — Reachable AssertionCWE-20 — Improper Input Validation8 documents7 sources
Severity
7.5HIGHNVD
EPSS
5.6%
top 9.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Varnish-cache VarnishVarnish-software Varnish CacheVarnish Cache Project Varnish Cache+1 more
Timeline
PublishedSep 3
Latest updateMay 24

Description

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDvarnish-software/varnish_cache6.0.0 — 6.0.4
▶Debianvarnish-cache/varnish< 6.2.1-1+3

Also affects: Debian Linux 10.0

🔴Vulnerability Details

3
GHSA
GHSA-3775-frgh-j3vc: An issue was discovered in Varnish Cache before 6↗2022-05-24
▶
CVEList
CVE-2019-15892: An issue was discovered in Varnish Cache before 6↗2019-09-03
▶
OSV
CVE-2019-15892: An issue was discovered in Varnish Cache before 6↗2019-09-03
▶

📋Vendor Advisories

2
Red Hat
varnish: denial of service handling certain crafted HTTP/1 requests↗2019-09-03
▶
Debian
CVE-2019-15892: varnish - An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x b...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-15892 varnish: denial of service handling certain crafted HTTP/1 requests↗2019-09-26
▶
Bugzilla
CVE-2019-15892 varnish: denial of service handling certain crafted HTTP/1 requests [fedora-all]↗2019-09-26
▶
CVE-2019-15892 — Reachable Assertion in Varnish Cache | cvebase