Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4937 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3426 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages     in memory so web servers don't have to create the same web page over and over     again, giving the website a significant speed up.

    Security Fix(es):

    * varnish:6: HTTP/2 Broken Window Attack may result in denial of service     (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3305 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish:6: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2938 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in     memory so web servers don't have to create the same web page over and over     again, giving the website a significant speed up.

    Security Fix(es):

    * varnish:6: HTTP/2 Broken Window Attack may result in denial of service     (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1691 advisory.

  - Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before     6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window     Attack. (CVE-2024-30156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2820 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2700 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1690 advisory.

  - Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before     6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window     Attack. (CVE-2024-30156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1690 advisory.

  - Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before     6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window     Attack. (CVE-2024-30156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1691 advisory.

  - Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before     6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window     Attack. (CVE-2024-30156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1691 advisory.

    - Resolves: RHEL-30387 - varnish: HTTP/2 Broken Window Attack may result       in denial of service (CVE-2024-30156)
    - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1690 advisory.

    varnish     [6.0.13-1]
    - new version 6.0.13
    - Resolves: RHEL-30378 - varnish:6/varnish: HTTP/2 Broken Window Attack may       result in denial of service (CVE-2024-30156)

    varnish-modules

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1690 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1691 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1689 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210477	RHEL 8 : varnish:6 (RHSA-2024:4937)	Nessus	Red Hat Local Security Checks	high
197971	RHEL 8 : varnish:6 (RHSA-2024:3426)	Nessus	Red Hat Local Security Checks	high
197722	RHEL 8 : varnish:6 (RHSA-2024:3305)	Nessus	Red Hat Local Security Checks	high
197565	RHEL 8 : varnish:6 (RHSA-2024:2938)	Nessus	Red Hat Local Security Checks	high
196974	Rocky Linux 9 : varnish (RLSA-2024:1691)	Nessus	Rocky Linux Local Security Checks	high
196898	RHEL 9 : varnish (RHSA-2024:2820)	Nessus	Red Hat Local Security Checks	high
195018	RHEL 9 : varnish (RHSA-2024:2700)	Nessus	Red Hat Local Security Checks	high
195011	Rocky Linux 8 : varnish (RLSA-2024:1690)	Nessus	Rocky Linux Local Security Checks	high
193167	AlmaLinux 8 : varnish (ALSA-2024:1690)	Nessus	Alma Linux Local Security Checks	high
193157	AlmaLinux 9 : varnish (ALSA-2024:1691)	Nessus	Alma Linux Local Security Checks	high
193123	Oracle Linux 9 : varnish (ELSA-2024-1691)	Nessus	Oracle Linux Local Security Checks	high
193122	Oracle Linux 8 : varnish (ELSA-2024-1690)	Nessus	Oracle Linux Local Security Checks	high
192972	RHEL 8 : varnish (RHSA-2024:1690)	Nessus	Red Hat Local Security Checks	high
192969	RHEL 9 : varnish (RHSA-2024:1691)	Nessus	Red Hat Local Security Checks	high
192968	RHEL 7 : rh-varnish6-varnish (RHSA-2024:1689)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-30156

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high