Red Hat Security AdvisoryRHSA-2024:1689
rh-varnish6-varnish security update
Released 2024-04-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-varnish6-varnish-6.0.13-1.el7, rh-varnish6-varnish-devel-6.0.13-1.el7, rh-varnish6-varnish-docs-6.0.13-1.el7 +2
- Red Hat Software Collections for RHEL(v. 7) rh-varnish6-varnish-6.0.13-1.el7, rh-varnish6-varnish-devel-6.0.13-1.el7, rh-varnish6-varnish-docs-6.0.13-1.el7 +2
Fixes 1 record
Priority MEDIUM 45
Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03663 · Published 2024-03-24 · Fixed CWE-770
