CVE-2019-15892
CVE-2019-15892
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
CVSS 7.5 · High · EPSS 5.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- https://varnish-cache.org/security/VSV00003.html
- https://seclists.org/bugtraq/2019/Sep/5
- https://www.debian.org/security/2019/dsa-4514
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00069.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLSF54TDJWJLINIFEW5V5BKDNY5EQRR3/
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00089.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3OEOCYRU43TWEU2C65F3D6GK64MSWNNK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBAQF6UDRSTURGINIMSMLJR4PTDYWA7C/
- https://nvd.nist.gov/vuln/detail/CVE-2019-15892