CVE-2023-41104: Buffer Overflow
libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-41104.
What is the severity of CVE-2023-41104?
The severity of CVE-2023-41104 is medium.
What software is affected by CVE-2023-41104?
Varnish Enterprise 6.0.x versions before 6.0.11r5 and libvmod-digest versions before 1.0.3 are affected.
How does CVE-2023-41104 impact security?
CVE-2023-41104 can lead to both authentication bypass and information disclosure due to an out-of-bounds memory access during base64 decoding.
Where can I find more information about CVE-2023-41104?
You can find more information about CVE-2023-41104 at the following sources: - [Varnish Software Security Advisory VSV00012](https://docs.varnish-software.com/security/VSV00012/) - [libvmod-digest 1.0.3 Release](https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3) - [Varnish Cache Security Advisory VSV00012](https://www.varnish-cache.org/security/VSV00012.html)