CVE-2023-41104

Опубликовано: 23 авг. 2023

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.

Ссылки

https://docs.varnish-software.com/security/VSV00012/
Mitigation
Vendor Advisory
https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3
Release Notes
https://www.varnish-cache.org/security/VSV00012.html
Patch
Vendor Advisory
https://docs.varnish-software.com/security/VSV00012/
Mitigation
Vendor Advisory
https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3
Release Notes
https://www.varnish-cache.org/security/VSV00012.html
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.11 (исключая)

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:-:*:*:*:*:*:*

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r1:*:*:*:*:*:*

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r2:*:*:*:*:*:*

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r3:*:*:*:*:*:*

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r4:*:*:*:*:*:*

cpe:2.3:a:varnish-software:vmod_digest:*:*:*:*:*:*:*:*

Версия до 1.0.3 (исключая)

EPSS

Процентиль: 40%

0.0018

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-119

Связанные уязвимости

GHSA-rrpc-jfj4-37w9