Security Information / 2013 / Security Information -- DSA-2814-1 varnish

Debian Security Advisory

DSA-2814-1 varnish -- denial of service

Date Reported:

09 Dec 2013

Affected Packages:

varnish

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 728989.
In Mitre's CVE dictionary: CVE-2013-4484.

More information:

A denial of service vulnerability was reported in varnish, a state of the art, high-performance web accelerator. With some configurations of varnish a remote attacker could mount a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.

For the oldstable distribution (squeeze), this problem has been fixed in version 2.1.3-8+deb6u1.

For the stable distribution (wheezy), this problem has been fixed in version 3.0.2-2+deb7u1.

For the unstable distribution (sid), this problem has been fixed in version 3.0.5-1.

We recommend that you upgrade your varnish packages.