CVE-2021-28543: Null Pointer Dereference
First published: Tue Mar 16 2021(Updated: )
Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to install both Varnish Cache and varnish-modules. Specifically, an assertion failure or NULL pointer dereference can be triggered in Varnish Cache through the varnish-modules header.append() and header.copy() functions. For some Varnish Configuration Language (VCL) files, this gives remote clients an opportunity to cause a Varnish Cache restart. A restart reduces overall availability and performance due to an increased number of cache misses, and may cause higher load on backend servers.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Varnish-cache Varnish-modules | <0.17.1 | |
| Varnish-cache Varnish-modules Klarlack | <0.17.1 | |
| Fedoraproject Fedora | =34 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPFBRQUJNWHCB3GQHSSAPRLQU6Q6PY43/
- https://varnish-cache.org/security/VSV00006.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPFBRQUJNWHCB3GQHSSAPRLQU6Q6PY43/
Frequently Asked Questions
What is CVE-2021-28543?
CVE-2021-28543 is a vulnerability that allows remote attackers to cause a denial of service in Varnish varnish-modules before version 0.17.1.
How does CVE-2021-28543 affect Varnish Cache and varnish-modules?
CVE-2021-28543 does not affect organizations that only install Varnish Cache, but it does affect those that install both Varnish Cache and varnish-modules.
What is the severity of CVE-2021-28543?
CVE-2021-28543 has a severity level of 7.5, which is considered high.
What is the fix for CVE-2021-28543?
To fix CVE-2021-28543, upgrade Varnish varnish-modules to version 0.17.1 or later.
Where can I find more information about CVE-2021-28543?
You can find more information about CVE-2021-28543 at the following references: [Reference 1](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPFBRQUJNWHCB3GQHSSAPRLQU6Q6PY43/) and [Reference 2](https://varnish-cache.org/security/VSV00006.html).
- collector/nvd-index
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/varnish-cache
- canonical/varnish-cache varnish-modules
- canonical/varnish-cache varnish-modules klarlack
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34