Re: Varnish - no CVE == bug regression

[Stefan Bühler <stbuehler () lighttpd net>]

Hi,

On Thu, 3 Jul 2014 21:07:39 +0100
Marek Kroemeke <kroemeke () gmail com> wrote:

> I doubt that CDNs like Akamai, Fastly(varnish?), Cloudflare(nginx?)
> etc.. would agree that the fact that a core part of their
> infrastructure could be DoSed by one of their users is not a security
> vulnerability, but I'm happy to be in minority regarding this view.

As long as varnish has no high priority to protect itself against
malicious backends I'd say it is not suited to be a frontend proxy in a
CDN network (you could use a seperate varnish instance for each
application/"trust group" though).

Different implementations have different priorities; choose one that
matches your requirements.

regards,
Stefan