oss-sec mailing list archives

Re: Varnish - no CVE == bug regression


From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 03 Jul 2014 01:48:45 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/07/14 01:42 AM, Poul-Henning Kamp wrote:
In message
<CAOurorZCjmrrw0MPhca=8+qjLKofrhdHsJuee5_=rCBv87SPbg () mail gmail com>,
Marek Kroemeke writes:

I'm not entirely convinced that there is a trust relationship
between the cache and the backend in every single use case.

It may not be total trust, but trust there is:  On party delivers 
the other partys web-property.

But as I said:  We will fix bugs, but we don't consider them DoS
vulns.

So as I understand this: Varnish front end for web servers, the web
servers can trigger varnish to restart. Are the back end servers
supposed to be able to cause varnish to restart?

I'm guessing not. Scenario: hosting env, or a website with a vuln,
whatever, you can now cause the varnish front ends to restart
constantly, effectively causing a permanent denial of service.

That sounds CVE worthy. Or am I missing something?


- -- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJTtQrdAAoJEBYNRVNeJnmT5qQQAMa9unISL+L/ED3uYEAdz7h6
pt+zDtXClXMpBYjEcEhLkl0g9sMx/Uh0nU2xKXoBkCfX7ned2PECn6bixGdP4zGj
fSPUbttBnot2saq9agzdVqlWsTZ2v/XHw1vNa31GxZGcyhyytQE7Y/ccjHX1+INw
eehdpxp2uePF6NYAFOQDpTzPhjjPZRkue6yCV+pPxRzX9ryW2QGfC1OQnWb67tmz
sT8tnKBK7Iot+qFNt/zo4OE4kCL5iWmLm/hXiWVjuGN26hGN855lCH0mlLTCWysN
Noxyf/7LSiMe7s2Q6Xp9+M6pYC5t/BsFhV+OvSkWME7tL1jO4+daq7YgY9v38V53
J8S4V6tsQNkNfEmQalPDVQB0YAXnReIVnqGyKoeL1WQVRPMxaKV0+ZIUTjYIUd4E
2bW+bUxGRT6bhVd3CJ3dmmc/G6W+0kghjZIXIq8Ru/aLK4ARsehts9ihz2XnBsAT
VX9wsxwibwrf5cTj/sS1Ap23NYzYhld0+GVjbH7gdaWyts+CSPTk3BiT8KTpjLXj
44LNR1UTt6T6LVNGOzw+E5/7gj+trZW5cLDHHcmQUqaMcEYXUzm8rsem5Qv0GdZL
RbBCBuF/pg/mW5NpW9Wq7gEjzOq9o2TJNgFrkc9IT0b/EdX/UBFIo9w46188/a8Z
avNfepsLqUvODonYpG72
=flp8
-----END PGP SIGNATURE-----


Current thread: