CVEvulnerability
CVE-2023-41104
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-08-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-119
Description
libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.
Affected configurations
• varnish-software varnish enterprise (>= 6.0.0 < 6.0.11)
• varnish-software varnish enterprise 6.0.11
• varnish-software vmod digest (< 1.0.3)
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- https://docs.varnish-software.com/security/VSV00012/ Mitigation, Vendor Advisory
- https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3 Release Notes
- https://www.varnish-cache.org/security/VSV00012.html Patch, Vendor Advisory
- https://docs.varnish-software.com/security/VSV00012/ Mitigation, Vendor Advisory
- https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3 Release Notes
- https://www.varnish-cache.org/security/VSV00012.html Patch, Vendor Advisory