oss-sec mailing list archives
Re: Varnish - no CVE == bug regression
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 03 Jul 2014 01:48:45 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 03/07/14 01:42 AM, Poul-Henning Kamp wrote:
In message <CAOurorZCjmrrw0MPhca=8+qjLKofrhdHsJuee5_=rCBv87SPbg () mail gmail com>, Marek Kroemeke writes:I'm not entirely convinced that there is a trust relationship between the cache and the backend in every single use case.It may not be total trust, but trust there is: On party delivers the other partys web-property. But as I said: We will fix bugs, but we don't consider them DoS vulns.
So as I understand this: Varnish front end for web servers, the web servers can trigger varnish to restart. Are the back end servers supposed to be able to cause varnish to restart? I'm guessing not. Scenario: hosting env, or a website with a vuln, whatever, you can now cause the varnish front ends to restart constantly, effectively causing a permanent denial of service. That sounds CVE worthy. Or am I missing something? - -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJTtQrdAAoJEBYNRVNeJnmT5qQQAMa9unISL+L/ED3uYEAdz7h6 pt+zDtXClXMpBYjEcEhLkl0g9sMx/Uh0nU2xKXoBkCfX7ned2PECn6bixGdP4zGj fSPUbttBnot2saq9agzdVqlWsTZ2v/XHw1vNa31GxZGcyhyytQE7Y/ccjHX1+INw eehdpxp2uePF6NYAFOQDpTzPhjjPZRkue6yCV+pPxRzX9ryW2QGfC1OQnWb67tmz sT8tnKBK7Iot+qFNt/zo4OE4kCL5iWmLm/hXiWVjuGN26hGN855lCH0mlLTCWysN Noxyf/7LSiMe7s2Q6Xp9+M6pYC5t/BsFhV+OvSkWME7tL1jO4+daq7YgY9v38V53 J8S4V6tsQNkNfEmQalPDVQB0YAXnReIVnqGyKoeL1WQVRPMxaKV0+ZIUTjYIUd4E 2bW+bUxGRT6bhVd3CJ3dmmc/G6W+0kghjZIXIq8Ru/aLK4ARsehts9ihz2XnBsAT VX9wsxwibwrf5cTj/sS1Ap23NYzYhld0+GVjbH7gdaWyts+CSPTk3BiT8KTpjLXj 44LNR1UTt6T6LVNGOzw+E5/7gj+trZW5cLDHHcmQUqaMcEYXUzm8rsem5Qv0GdZL RbBCBuF/pg/mW5NpW9Wq7gEjzOq9o2TJNgFrkc9IT0b/EdX/UBFIo9w46188/a8Z avNfepsLqUvODonYpG72 =flp8 -----END PGP SIGNATURE-----
Current thread:
- Varnish - no CVE == bug regression Marek Kroemeke (Jul 02)
- Re: Varnish - no CVE == bug regression Solar Designer (Jul 02)
- Re: Varnish - no CVE == bug regression Poul-Henning Kamp (Jul 02)
- Re: Varnish - no CVE == bug regression Marek Kroemeke (Jul 02)
- Re: Varnish - no CVE == bug regression Poul-Henning Kamp (Jul 03)
- Re: Varnish - no CVE == bug regression Kurt Seifried (Jul 03)
- Re: Varnish - no CVE == bug regression Sven Kieske (Jul 03)
- Re: Varnish - no CVE == bug regression Stefan Bühler (Jul 03)
- Re: Varnish - no CVE == bug regression Kurt Seifried (Jul 03)
- Re: Varnish - no CVE == bug regression Marek Kroemeke (Jul 03)
- Re: Varnish - no CVE == bug regression Stefan Bühler (Jul 03)
- Re: Varnish - no CVE == bug regression Stefan Bühler (Jul 03)
- Re: Varnish - no CVE == bug regression Kurt Seifried (Jul 03)
- Re: Varnish - no CVE == bug regression Seth Arnold (Jul 03)
- Re: Varnish - no CVE == bug regression Poul-Henning Kamp (Jul 02)
- Re: Varnish - no CVE == bug regression Sven Kieske (Jul 04)
- Re: Varnish - no CVE == bug regression Solar Designer (Jul 02)
- Re: Varnish - no CVE == bug regression Poul-Henning Kamp (Jul 05)