NVD

Id
28880  
Name
CVE-2015-8852  
Description
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-04-25  
Modified Date
2016-11-30  
Seq
2015-8852  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
152182 28880 CVE-2015-8852 openSUSE-SU-2016:1316  View
152183 28880 CVE-2015-8852 DSA-3553  View
152184 28880 CVE-2015-8852 [oss-security] 20160416 CVE request: Varnish 3 before 3.0.7 was vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL  View
152185 28880 CVE-2015-8852 [oss-security] 20160418 Re: CVE request: Varnish 3 before 3.0.7 was vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL  View
152186 28880 CVE-2015-8852 https://github.com/varnish/Varnish-Cache/commit/29870c8fe95e4e8a672f6f28c5fbe692bea09e9c  View
152187 28880 CVE-2015-8852 https://github.com/varnish/Varnish-Cache/commit/85e8468bec9416bd7e16b0d80cb820ecd2b330c3  View
152188 28880 CVE-2015-8852 GLSA-201607-10  View
152189 28880 CVE-2015-8852 [varnish-announce] 20150323 Varnish 3.0.7 released.  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11801 JVNDB-2015-007121 Varnish における任意の HTTP ヘッダを挿入される脆弱性 Varnish には、特定のスタックしたインストールに使用される場合、任意の HTTP ヘッダを挿入され、HTTP レスポンス分割攻撃を実行される脆弱性が存在します。 CVE-2015-8852 86077 CVE-2015-8852 28880 5 7.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-007121.html 2015-03-23 2016-05-10 View