Red Hat Security AdvisoryRHSA-2024:2938
varnish:6 security update
Released 2024-05-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6, varnish-devel-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6 +3
- Red Hat Enterprise Linux AppStream E4S (v.8.4) varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.ppc64le::varnish:6, varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6 +7
- Red Hat Enterprise Linux AppStream TUS (v.8.4) varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6, varnish-devel-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6 +3
Fixes 1 record
Priority MEDIUM 45
Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03663 · Published 2024-03-24 · Fixed CWE-770
