CVE - CVE-2015-8852

CVE-ID
CVE-2015-8852	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/varnish/Varnish-Cache/commit/29870c8fe95e4e8a672f6f28c5fbe692bea09e9c CONFIRM:https://github.com/varnish/Varnish-Cache/commit/85e8468bec9416bd7e16b0d80cb820ecd2b330c3 DEBIAN:DSA-3553 URL:http://www.debian.org/security/2016/dsa-3553 GENTOO:GLSA-201607-10 URL:https://security.gentoo.org/glsa/201607-10 MLIST:[oss-security] 20160416 CVE request: Varnish 3 before 3.0.7 was vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL URL:http://www.openwall.com/lists/oss-security/2016/04/16/1 MLIST:[oss-security] 20160418 Re: CVE request: Varnish 3 before 3.0.7 was vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL URL:http://www.openwall.com/lists/oss-security/2016/04/18/7 MLIST:[varnish-announce] 20150323 Varnish 3.0.7 released. URL:https://www.varnish-cache.org/lists/pipermail/varnish-announce/2015-March/000701.html SUSE:openSUSE-SU-2016:1316 URL:http://lists.opensuse.org/opensuse-updates/2016-05/msg00064.html
Assigning CNA
MITRE Corporation
Date Record Created
20160418	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20160418)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)