varnish-cache varnish-modules, varnish-cache varnish-modules klarlack, fedoraproject fedora
CVSS 7.5 · High EPSS 1,5%
Kerentanan NULL Pointer Dereference pada varnish-cache varnish-modules, varnish-cache varnish-modules klarlack +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.
Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to install both Varnish Cache and varnish-modules. Specifically, an assertion failure or NULL pointer dereference can be triggered in Varnish Cache through the varnish-modules header.append() and header.copy() functions. For some Varnish Configuration Language (VCL) files, this gives remote clients an opportunity to cause a Varnish Cache restart. A restart reduces overall availability and performance due to an increased number of cache misses, and may cause higher load on backend servers.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| varnish-cache | varnish-modules | Semua versi sebelum 0.17.1 |
| varnish-cache | varnish-modules klarlack | Semua versi sebelum 0.17.1 |
| fedoraproject | fedora | Versi 34 |