Varnish: Multiple vulnerabilities

Varnish: Multiple vulnerabilities Improper input validation in Varnish allows remote attackers to conduct HTTP smuggling attacks, and possibly trigger a buffer overflow. 2016-07-20 2016-07-20 542886 remote 3.0.7 3.0.7

Varnish is a web application accelerator.

Varnish fails to properly validate input from HTTP headers, and does not deny requests with multiple Content-Length headers.

Remote attackers could conduct an HTTP response splitting attack, which may further enable them to conduct Cross-Site Scripting (XSS), Cache Poisoning, Defacement, and Page Hijacking.

There is no known workaround at this time.

All Varnish users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=www-servers/varnish-3.0.7"

CVE-2015-8852 b-man b-man