Описание
Security update for varnish
This update for varnish fixes the following issues:
Changes in varnish:
-
update to 7.7.3 (bsc#1280114, CVE-2025-8671):
-
Update to release 7.7.1
- VSV-16: Resolve request smuggling attack
-
Update to release 7.7.0
- The
linuxjail gained control of transparent huge pages settings. - An issue has been fixed which could cause a crash when varnishd receives an invalid Content-Range header from a backend.
- Timestamping for HTTP/2 requests (when idle period begins) has been switched to be more in line with HTTP/1.
- VSV-15: The client connection is now always closed when a malformed request is received. [CVE-2025-30346, boo#1239892]
- The
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1239892
- SUSE Bug 1280114
- SUSE CVE CVE-2025-30346 page
- SUSE CVE CVE-2025-8671 page
Описание
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.
Затронутые продукты
Ссылки
- CVE-2025-30346
- SUSE Bug 1239892
Описание
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them-using malformed frames or flow control errors-an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.
Затронутые продукты
Ссылки
- CVE-2025-8671
- SUSE Bug 1243888
- SUSE Bug 1243895
- SUSE Bug 1250054