CVE-2019-15892

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\n Security Fix(es):\r\n\r\n An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.(CVE-2019-15892)\r\n\r\n

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

The following packages have been upgraded to a later upstream version: varnish (6.0.6). (BZ#1795673)

Security Fix(es):

• varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)

• varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)

• varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

This update for varnish fixes the following issues:

Security issue fixed:

• CVE-2019-15892: Fixed a potential denial of service by sending crafted HTTP/1 requests (boo#1149382).

Non-security issues fixed:

• Updated the package to release 6.2.1.
• Added a thread pool watchdog which will restart the worker process if scheduling tasks onto worker threads appears stuck. The new parameter 'thread_pool_watchdog' configures it.
• Disabled error for clobbering, which caused bogus error in varnishtest.

This update for varnish fixes the following issues:

Security issue fixed:

• CVE-2019-15892: Fixed a potential denial of service by sending crafted HTTP/1 requests (boo#1149382).

Non-security issues fixed:

• Updated the package to release 6.2.1.
• Added a thread pool watchdog which will restart the worker process if scheduling tasks onto worker threads appears stuck. The new parameter 'thread_pool_watchdog' configures it.
• Disabled error for clobbering, which caused bogus error in varnishtest.

This update was imported from the openSUSE:Leap:15.0:Update update project.

These are all security issues fixed in the libvarnishapi2-6.6.1-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libvinylapi3-9.0.0-1.1 package on the GA media of openSUSE Tumbleweed.