[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <53B50ADD.30508@redhat.com>
Date: Thu, 03 Jul 2014 01:48:45 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, Marek Kroemeke <kroemeke@...il.com>
CC: Solar Designer <solar@...nwall.com>, varnish-misc@...nish-cache.org
Subject: Re: Varnish - no CVE == bug regression
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/07/14 01:42 AM, Poul-Henning Kamp wrote:
> In message
> <CAOurorZCjmrrw0MPhca=8+qjLKofrhdHsJuee5_=rCBv87SPbg@...l.gmail.com>,
> Marek Kroemeke writes:
>
>> I'm not entirely convinced that there is a trust relationship
>> between the cache and the backend in every single use case.
>
> It may not be total trust, but trust there is: On party delivers
> the other partys web-property.
>
> But as I said: We will fix bugs, but we don't consider them DoS
> vulns.
So as I understand this: Varnish front end for web servers, the web
servers can trigger varnish to restart. Are the back end servers
supposed to be able to cause varnish to restart?
I'm guessing not. Scenario: hosting env, or a website with a vuln,
whatever, you can now cause the varnish front ends to restart
constantly, effectively causing a permanent denial of service.
That sounds CVE worthy. Or am I missing something?
- --
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJTtQrdAAoJEBYNRVNeJnmT5qQQAMa9unISL+L/ED3uYEAdz7h6
pt+zDtXClXMpBYjEcEhLkl0g9sMx/Uh0nU2xKXoBkCfX7ned2PECn6bixGdP4zGj
fSPUbttBnot2saq9agzdVqlWsTZ2v/XHw1vNa31GxZGcyhyytQE7Y/ccjHX1+INw
eehdpxp2uePF6NYAFOQDpTzPhjjPZRkue6yCV+pPxRzX9ryW2QGfC1OQnWb67tmz
sT8tnKBK7Iot+qFNt/zo4OE4kCL5iWmLm/hXiWVjuGN26hGN855lCH0mlLTCWysN
Noxyf/7LSiMe7s2Q6Xp9+M6pYC5t/BsFhV+OvSkWME7tL1jO4+daq7YgY9v38V53
J8S4V6tsQNkNfEmQalPDVQB0YAXnReIVnqGyKoeL1WQVRPMxaKV0+ZIUTjYIUd4E
2bW+bUxGRT6bhVd3CJ3dmmc/G6W+0kghjZIXIq8Ru/aLK4ARsehts9ihz2XnBsAT
VX9wsxwibwrf5cTj/sS1Ap23NYzYhld0+GVjbH7gdaWyts+CSPTk3BiT8KTpjLXj
44LNR1UTt6T6LVNGOzw+E5/7gj+trZW5cLDHHcmQUqaMcEYXUzm8rsem5Qv0GdZL
RbBCBuF/pg/mW5NpW9Wq7gEjzOq9o2TJNgFrkc9IT0b/EdX/UBFIo9w46188/a8Z
avNfepsLqUvODonYpG72
=flp8
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
