[ GLSA 201412-30 ] Varnish: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: Varnish: Multiple vulnerabilities (GLSA 201412-30)
Severity: normal
Exploitable: local, remote
Date: December 15, 2014
Bug(s): #458888, #489944
ID: 201412-30

Synopsis

Multiple vulnerabilities have been found in Varnish, the worst of
which could allow a remote attacker to create a Denial of Service
condition.


Background

Varnish is a web application accelerator.

Affected Packages

Package: www-servers/varnish
Vulnerable: < 3.0.5
Unaffected: >= 3.0.5
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in Varnish. Please review
the CVE identifiers referenced below for details.


Impact

A remote attacker could cause a Denial of Service condition via a
specially crafted GET request. Furthermore a local attacker could obtain
sensitive information through insecure permissions on logfiles.


Workaround

There is no known workaround at this time.

Resolution

All Varnish users should upgrade to the latest version: