The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5474-1 advisory.

    It was dicovered that Varnish Cache did not clear a pointer between the handling of one client request and     the next request within the same connection. A remote attacker could possibly use this issue to obtain     sensitive information. (CVE-2019-20637)

    It was discovered that Varnish Cache could have an assertion failure when a TLS termination proxy uses     PROXY version 2. A remote attacker could possibly use this issue to restart the daemon and cause a     performance loss. (CVE-2020-11653)

    It was discovered that Varnish Cache allowed request smuggling and VCL authorization bypass via a large     Content-Length header for a POST request. A remote attacker could possibly use this issue to obtain     sensitive information. (CVE-2021-36740)

    It was discovered that Varnish Cache allowed request smuggling for HTTP/1 connections. A remote attacker     could possibly use this issue to obtain sensitive information. (CVE-2022-23959)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Varnish Cache vulnerabilities (USN-5474-1)

critical Nessus Plugin ID 161982

Version 1.6