CVE

Id
86129  
CVE No.
CVE-2015-8852  
Status
Candidate  
Description
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.  
Phase
Assigned (20160418)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
757431 86129 CVE-2015-8852 MLIST:[oss-security] 20160416 CVE request: Varnish 3 before 3.0.7 was vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL  View
757432 86129 CVE-2015-8852 URL:http://www.openwall.com/lists/oss-security/2016/04/16/1  View
757433 86129 CVE-2015-8852 MLIST:[oss-security] 20160418 Re: CVE request: Varnish 3 before 3.0.7 was vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL  View
757434 86129 CVE-2015-8852 URL:http://www.openwall.com/lists/oss-security/2016/04/18/7  View
757435 86129 CVE-2015-8852 MLIST:[varnish-announce] 20150323 Varnish 3.0.7 released.  View
757436 86129 CVE-2015-8852 URL:https://www.varnish-cache.org/lists/pipermail/varnish-announce/2015-March/000701.html  View
757437 86129 CVE-2015-8852 CONFIRM:https://github.com/varnish/Varnish-Cache/commit/29870c8fe95e4e8a672f6f28c5fbe692bea09e9c  View
757438 86129 CVE-2015-8852 CONFIRM:https://github.com/varnish/Varnish-Cache/commit/85e8468bec9416bd7e16b0d80cb820ecd2b330c3  View
757439 86129 CVE-2015-8852 DEBIAN:DSA-3553  View
757440 86129 CVE-2015-8852 URL:http://www.debian.org/security/2016/dsa-3553  View
757441 86129 CVE-2015-8852 GENTOO:GLSA-201607-10  View
757442 86129 CVE-2015-8852 URL:https://security.gentoo.org/glsa/201607-10  View
757443 86129 CVE-2015-8852 SUSE:openSUSE-SU-2016:1316  View

Related JVN