Description
libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.
Metrics
CVSS 3.1 6.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| libvmod_digest | libvmod_digest | < 1.0.3; >= varnish_enterprise_6.0x, < 6.0.11r5 |
References
- https://docs.varnish-software.com/security/VSV00012/Mitigation, Vendor Advisory
- https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3Release Notes
- https://www.varnish-cache.org/security/VSV00012.htmlPatch, Vendor Advisory
- https://docs.varnish-software.com/security/VSV00012/Mitigation, Vendor Advisory
- https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3Release Notes
- https://www.varnish-cache.org/security/VSV00012.htmlPatch, Vendor Advisory
Timeline
- Published
- Aug 23, 2023
- Last modified
- Jun 17, 2026
- NVD status
- Modified