Debian Security Advisory
DSA-2814-1 varnish -- denial of service
- Date Reported:
- 09 Dec 2013
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 728989.
In Mitre's CVE dictionary: CVE-2013-4484.
- More information:
A denial of service vulnerability was reported in varnish, a state of the art, high-performance web accelerator. With some configurations of varnish a remote attacker could mount a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.
For the oldstable distribution (squeeze), this problem has been fixed in version 2.1.3-8+deb6u1.
For the stable distribution (wheezy), this problem has been fixed in version 3.0.2-2+deb7u1.
For the unstable distribution (sid), this problem has been fixed in version 3.0.5-1.
We recommend that you upgrade your varnish packages.