CVE-2015-8852
CVE-2015-8852
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
CVSS 7.5 · High · EPSS 3.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
varnish Debian:12
- Affected ranges
- ECOSYSTEM: < 4.0.0-1
Update to 4.0.0-1
varnish Debian:13
- Affected ranges
- ECOSYSTEM: < 4.0.0-1
Update to 4.0.0-1
varnish Ubuntu:14.04:LTS
- Versions
- 3.0.4-1ubuntu1
- 3.0.4-1ubuntu2
- 3.0.5-1ubuntu2
- 3.0.5-2
- Affected ranges
- ECOSYSTEM: < 3.0.5-2ubuntu0.1
Update to 3.0.5-2ubuntu0.1
Original sources
- http://www.debian.org/security/2016/dsa-3553
- https://www.varnish-cache.org/lists/pipermail/varnish-announce/2015-March/000701.html
- http://www.openwall.com/lists/oss-security/2016/04/18/7
- https://security.gentoo.org/glsa/201607-10
- https://github.com/varnish/Varnish-Cache/commit/29870c8fe95e4e8a672f6f28c5fbe692bea09e9c
- https://github.com/varnish/Varnish-Cache/commit/85e8468bec9416bd7e16b0d80cb820ecd2b330c3
- http://www.openwall.com/lists/oss-security/2016/04/16/1
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00064.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-8852