CVE-2019-15892: debian debian_linux Reachable Assertion
CVSS: 7.8v2.0HighModified
AliasesALPINE-CVE-2019-15892openSUSE-SU-2019:2221-1RHEA-2020:2262UBUNTU-CVE-2019-15892DEBIAN-CVE-2019-15892DSA-4514-1openSUSE-SU-2019:2184-1openSUSE-SU-2024:11493-1
Published 03-09-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-15892 is a high (CVSS 7.8) Reachable Assertion vulnerability in debian debian_linux. EPSS estimates a 5.90% chance of exploitation in the next 30 days, higher than 93.1% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v2.0 (NVD)EPSS score
5.90%
0%100%
Low · +0.11 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 03-09-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.8Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
5.90%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
+0.11 pp
From 5.79% on 20-09-2026
20-09-202620-10-2026
EPSS score5.90%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- rh-varnish6< 0:4.1-6.el7
- rh-varnish6-runtime< 0:4.1-6.el7
- rh-varnish6-scldevel< 0:4.1-6.el7
- rh-varnish6-varnish< 0:6.0.6-1.el7
- rh-varnish6-varnish-devel< 0:6.0.6-1.el7
Opensuse3 products
- varnish&distro=openSUSE Leap 15.0< 6.2.1-lp151.3.3.1
- varnish&distro=openSUSE Leap 15.1< 6.2.1-lp151.3.3.1
- varnish&distro=openSUSE Tumbleweed< 6.6.1-1.2
Debian2 products
- varnish< 6.2.1-1 | < 6.1.1-1+deb10u1
- debian_linuxEOL10.0
Suse2 products
- varnish&distro=SUSE Package Hub 15< 6.2.1-bp151.4.3.1
- varnish&distro=SUSE Package Hub 15 SP1< 6.2.1-bp151.4.3.1
Alpine1 product
- varnish< 6.2.1-r0 | < 6.0.4-r0
Ubuntu1 product
- varnish< 6.2.1-2
Varnish_cache_project1 product
- varnish_cache≥ 6.1.0, ≤ 6.1.1 | ≥ 6.2.0, < 6.2.1
Varnish-software1 product
- varnish_cache≥ 6.0.0, < 6.0.4
8 vendors · 20 products
References
32 links
- lists.opensuse.org/archives/…Advisory
Show all 32 references
- lists.opensuse.org/archives/…Advisory