An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack. https://seclists.org/bugtraq/2019/Sep/5 https://varnish-cache.org/security/VSV00003.html
Created varnish tracking bugs for this issue: Affects: fedora-all [bug 1756081]
External References: https://varnish-cache.org/security/VSV00003.html
Mitigation: This flaw can be mitigated by using making changes in varnish configuration by using VCL (Varnish Configuration Language). More details available at: https://varnish-cache.org/security/VSV00003-mitigation.html#vsv00003-mitigation
Upstream patch: https://github.com/varnishcache/varnish-cache/commit/406b583fe54634afd029e7a41e35b3cf9ccac28a
Statement: This is a remote denial of service flaw in varnish cache application. It causes varnish to restart, with a clean cache, since the purpose of varnish is to cache web pages thereby improving overall web server performance, an attacker can cause web performance to degrade due to this attack.
This CVE was patched 10 days ago in rawhide, and a week ago in f29. I had forgotten to push updates for f30 and f31, sorry about that. f29: FEDORA-2019-8a85a90af6 varnish-6.0.4-3.fc29, in testing, waiting for stable f30: FEDORA-2019-feec5e0afd varnish-6.3.0-1.fc30, waiting for testing, please provide karma f31: FEDORA-2019-a0a0cdef92 varnish-6.3.0-1.fc31, waiting for testing, please provide karma f32: FEDORA-2019-5c224d8c93 varnish-6.3.0-1.fc31, stable 10 days ago Ingvar
Ingvar, This is a CVE flaw, please do not move this to ON_QA, you can do that with fedora tracker at: https://bugzilla.redhat.com/show_bug.cgi?id=1756081
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-15892
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4756 https://access.redhat.com/errata/RHSA-2020:4756