CVE-2020-11653 — Reachable Assertion in Varnish Cache

CWE-617 — Reachable AssertionCWE-400 — Uncontrolled Resource ConsumptionCWE-20 — Improper Input Validation11 documents8 sources
Severity
7.5HIGHNVD
EPSS
1.3%
top 20.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Varnish-cache VarnishVarnish-cache Varnish CacheVarnish-software Varnish Cache+3 more
Timeline
PublishedApr 8
Latest updateAug 23

Description

An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶NVDvarnish-cache/varnish_cache6.1.0 — 6.2.3+1
▶NVDvarnish-software/varnish_cache6.0.0 — 6.0.6
▶Debianvarnish-cache/varnish< 6.4.0-1+3
▶Ubuntuvarnish-cache/varnish< 6.2.1-2ubuntu0.2
▶NVDopensuse/leap15.1

Also affects: Debian Linux 10.0

🔴Vulnerability Details

5
OSV
varnish regression↗2022-08-23
▶
OSV
varnish vulnerabilities↗2022-06-08
▶
GHSA
GHSA-jg36-89rw-qgr3: An issue was discovered in Varnish Cache before 6↗2022-05-24
▶
CVEList
CVE-2020-11653: An issue was discovered in Varnish Cache before 6↗2020-04-08
▶
OSV
CVE-2020-11653: An issue was discovered in Varnish Cache before 6↗2020-04-08
▶

📋Vendor Advisories

4
Ubuntu
Varnish Cache regression↗2022-08-23
▶
Ubuntu
Varnish Cache vulnerabilities↗2022-06-08
▶
Red Hat
varnish: remote clients may cause Varnish to assert and restart which could result in DoS↗2020-02-04
▶
Debian
CVE-2020-11653: varnish - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x befor...↗2020
▶

💬Community

1
Bugzilla
CVE-2020-11653 varnish: remote clients may cause Varnish to assert and restart which could result in DoS↗2020-03-16
▶
CVE-2020-11653 — Reachable Assertion in Varnish Cache | cvebase