CVE-2023-41104

Katalog CVE

CVSS 6.5 · Medium EPSS 0,60%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada varnish-software varnish enterprise, varnish-software vmod digest. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.

Rincian

Terbit di NVD

23 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.varnish-software.com/security/VSV00012/ mitigasi · advisory vendor
• https://www.varnish-cache.org/security/VSV00012.html patch · advisory vendor
• https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3 release notes