The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4756 advisory.

    - Resolves: #1790907 - CVE-2019-20637 varnish: not clearing pointer between two       client requests leads to information disclosure
    - Resolves: #1763958 - CVE-2019-15892 varnish:6/varnish: denial of service       handling certain crafted HTTP/1 requests

    varnish-modules

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5474-1 advisory.

    It was dicovered that Varnish Cache did not clear a pointer between the handling of one client request and     the next request within the same connection. A remote attacker could possibly use this issue to obtain     sensitive information. (CVE-2019-20637)

    It was discovered that Varnish Cache could have an assertion failure when a TLS termination proxy uses     PROXY version 2. A remote attacker could possibly use this issue to restart the daemon and cause a     performance loss. (CVE-2020-11653)

    It was discovered that Varnish Cache allowed request smuggling and VCL authorization bypass via a large     Content-Length header for a POST request. A remote attacker could possibly use this issue to obtain     sensitive information. (CVE-2021-36740)

    It was discovered that Varnish Cache allowed request smuggling for HTTP/1 connections. A remote attacker     could possibly use this issue to obtain sensitive information. (CVE-2022-23959)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4756 advisory.

  - varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

  - varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)

  - varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5474-2 advisory.

    USN-5474-1 fixed vulnerabilities in Varnish Cache. Unfortunately the fix for CVE-2020-11653 was     incomplete. This update fixes the problem.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3208 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3208-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     November 27, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : varnish     Version        : 6.1.1-1+deb10u4     CVE ID         : CVE-2020-11653 CVE-2022-45060     Debian Bug     : 956307 1023751

    Martin van Kervel Smedshammer discovered a request forgery attack can be     performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An     attacker may introduce characters through the HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to     produce invalid HTTP/1 requests to the backend. This may in turn be used to     successfully exploit vulnerabilities in a server behind the Varnish server.

    For Debian 10 buster, these problems have been fixed in version     6.1.1-1+deb10u4.

    We recommend that you upgrade your varnish packages.

    For the detailed security status of varnish please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/varnish

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4756 advisory.

  - An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1     parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The     assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
    (CVE-2019-15892)

  - An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before     6.3.1. It does not clear a pointer between the handling of one client request and the next request within     the same connection. This sometimes causes information to be disclosed from the connection workspace, such     as data structures associated with previous requests within this connection or VCL-related temporary     headers. (CVE-2019-20637)

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for varnish fixes the following issues :

  - CVE-2019-20637: Fixed an information leak when handling     one client request and the next on the same connection     (boo#1169040)

  - CVE-2020-11653: Fixed a performance loss due to an     assertion failure and daemon restart when communicating     with TLS termination proxy that uses PROXY version 2     (boo#1169039)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4756 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    The following packages have been upgraded to a later upstream version: varnish (6.0.6). (BZ#1795673)

    Security Fix(es):

    * varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

    * varnish: remote clients may cause Varnish to assert and restart which could result in DoS     (CVE-2020-11653)

    * varnish: not clearing pointer between two client requests leads to information disclosure     (CVE-2019-20637)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
142772	Oracle Linux 8 : varnish:6 (ELSA-2020-4756)	Nessus	Oracle Linux Local Security Checks	11/12/2020	10/22/2024	high
161982	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Varnish Cache vulnerabilities (USN-5474-1)	Nessus	Ubuntu Local Security Checks	6/9/2022	8/27/2024	critical
145911	CentOS 8 : varnish:6 (CESA-2020:4756)	Nessus	CentOS Local Security Checks	2/1/2021	2/8/2023	high
164377	Ubuntu 20.04 LTS : Varnish Cache regression (USN-5474-2)	Nessus	Ubuntu Local Security Checks	8/24/2022	10/29/2024	high
168207	Debian dla-3208 : libvarnishapi-dev - security update	Nessus	Debian Local Security Checks	11/27/2022	1/22/2025	high
184825	Rocky Linux 8 : varnish:6 (RLSA-2020:4756)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	high
138686	openSUSE Security Update : varnish (openSUSE-2020-808)	Nessus	SuSE Local Security Checks	7/20/2020	2/29/2024	high
142443	RHEL 8 : varnish:6 (RHSA-2020:4756)	Nessus	Red Hat Local Security Checks	11/4/2020	3/15/2025	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high

high

high