CVE-2015-8852: High severity varnish cache vulnerability
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8852?
CVE-2015-8852 is classified as a high severity vulnerability due to its potential for remote exploitation and HTTP response splitting attacks.
How do I fix CVE-2015-8852?
To fix CVE-2015-8852, upgrade Varnish to version 3.0.7 or later that includes patches addressing this vulnerability.
What versions of Varnish are affected by CVE-2015-8852?
CVE-2015-8852 affects Varnish versions 3.0.0 through 3.0.6.
Can CVE-2015-8852 be exploited remotely?
Yes, CVE-2015-8852 can be exploited remotely by sending crafted HTTP requests.
What type of attacks does CVE-2015-8852 allow?
CVE-2015-8852 allows attackers to inject arbitrary HTTP headers, enabling HTTP response splitting attacks.