Lucene search

MitreCVE-2020-11653

HistoryApr 08, 2020 - 11:15 p.m.

CVE-2020-11653

2020-04-0823:15:12

CWE-617

mitre

web.nvd.nist.gov

161

varnish cache

cve-2020-11653

tls termination

proxy

proxy v2

assertion failure

daemon restart

performance loss

security issue

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

55.5%

JSON

An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.

Affected configurations

Nvd

Node

varnish-cachevarnish_cacheRange6.1.0–6.2.3-

varnish-cachevarnish_cacheRange6.3.0–6.3.2-

varnish-softwarevarnish_cacheRange6.0.0–6.0.6lts

Node

opensusebackports_sleMatch15.0sp1

opensuseleapMatch15.1

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
varnish-cachevarnish_cache*cpe:2.3:a:varnish-cache:varnish_cache:*:*:*:*:-:*:*:*
varnish-softwarevarnish_cache*cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:lts:*:*:*
opensusebackports_sle15.0cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
opensuseleap15.1cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
varnish-cache	varnish_cache	*	cpe:2.3:a:varnish-cache:varnish_cache:::::-:::*
varnish-software	varnish_cache	*	cpe:2.3:a:varnish-software:varnish_cache:::::lts:::*
opensuse	backports_sle	15.0	cpe:2.3:a:opensuse:backports_sle:15.0:sp1::::::
opensuse	leap	15.1	cpe:2.3:o:opensuse:leap:15.1:::::::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*