CVE-2019-15892 Denial of service in n/a
Remote attackers can cause a Denial of Service in Varnish Cache by sending crafted HTTP/1 requests that trigger an assertion failure and automatic restart.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15892?
CVE-2019-15892 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 3 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
Weakness: CWE-617
Which versions are affected by CVE-2019-15892?
It affects 3 products.
Linux distribution packages (14)
rh-varnish6 Red Hat:rhel_software_collections:3::el7 | All versions | 0:4.1-6.el7 |
rh-varnish6-runtime Red Hat:rhel_software_collections:3::el7 | All versions | 0:4.1-6.el7 |
rh-varnish6-scldevel Red Hat:rhel_software_collections:3::el7 | All versions | 0:4.1-6.el7 |
rh-varnish6-varnish Red Hat:rhel_software_collections:3::el7 | All versions | 0:6.0.6-1.el7 |
rh-varnish6-varnish-devel Red Hat:rhel_software_collections:3::el7 | All versions | 0:6.0.6-1.el7 |
rh-varnish6-varnish-docs Red Hat:rhel_software_collections:3::el7 | All versions | 0:6.0.6-1.el7 |
rh-varnish6-varnish-libs Red Hat:rhel_software_collections:3::el7 | All versions | 0:6.0.6-1.el7 |
rh-varnish6-varnish-modules Red Hat:rhel_software_collections:3::el7 | All versions | 0:0.15.0-6.el7 |
rh-varnish6-varnish-modules-debuginfo Red Hat:rhel_software_collections:3::el7 | All versions | 0:0.15.0-6.el7 |
varnish SUSE:Package Hub 15 | All versions | 6.2.1-bp151.4.3.1 |
varnish SUSE:Package Hub 15 SP1 | All versions | 6.2.1-bp151.4.3.1 |
varnish openSUSE:Leap 15.0 | All versions | 6.2.1-lp151.3.3.1 |
varnish openSUSE:Leap 15.1 | All versions | 6.2.1-lp151.3.3.1 |
varnish openSUSE:Tumbleweed | All versions | 6.6.1-1.2 |
Products include Debian Debian Linux, Varnish-Software Varnish Cache, Varnish Cache Project Varnish Cache.
How do I fix CVE-2019-15892?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-15892 being exploited?
There is no known exploitation of CVE-2019-15892 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2019-15892, DEBIAN-CVE-2019-15892, DSA-4514-1, GHSA-3775-frgh-j3vc, OESA-2021-1032, RHEA-2020:2262 and 3 more.