RHSA-2024:3426
Vulnerability from csaf_redhat
Published
2024-05-28 14:33
Modified
2025-11-21 19:03
Summary
Red Hat Security Advisory: varnish:6 security update

Notes

Topic
An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish:6: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the varnish:6 module is now available for Red Hat Enterprise\nLinux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Varnish Cache is a high-performance HTTP accelerator. It stores web pages\nin memory so web servers don\u0027t have to create the same web page over and over\nagain, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish:6: HTTP/2 Broken Window Attack may result in denial of service\n(CVE-2024-30156)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:3426",
        "url": "https://access.redhat.com/errata/RHSA-2024:3426"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2271486",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271486"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3426.json"
      }
    ],
    "title": "Red Hat Security Advisory: varnish:6 security update",
    "tracking": {
      "current_release_date": "2025-11-21T19:03:12+00:00",
      "generator": {
        "date": "2025-11-21T19:03:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2024:3426",
      "initial_release_date": "2024-05-28T14:33:18+00:00",
      "revision_history": [
        {
          "date": "2024-05-28T14:33:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-05-28T14:33:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T19:03:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)",
                  "product_id": "AppStream-8.6.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:8.6::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src::varnish:6",
                "product": {
                  "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src (varnish:6)",
                  "product_id": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=src\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src::varnish:6",
                "product": {
                  "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src (varnish:6)",
                  "product_id": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=src\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
                "product": {
                  "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64 (varnish:6)",
                  "product_id": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=x86_64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
                "product": {
                  "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64 (varnish:6)",
                  "product_id": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-devel@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=x86_64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
                "product": {
                  "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64 (varnish:6)",
                  "product_id": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-docs@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=x86_64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
                "product": {
                  "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64 (varnish:6)",
                  "product_id": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=x86_64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
                "product": {
                  "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64 (varnish:6)",
                  "product_id": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules-debuginfo@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=x86_64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
                "product": {
                  "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64 (varnish:6)",
                  "product_id": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules-debugsource@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=x86_64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
                "product": {
                  "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x (varnish:6)",
                  "product_id": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=s390x\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
                "product": {
                  "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x (varnish:6)",
                  "product_id": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-devel@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=s390x\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
                "product": {
                  "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x (varnish:6)",
                  "product_id": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-docs@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=s390x\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
                "product": {
                  "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x (varnish:6)",
                  "product_id": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=s390x\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
                "product": {
                  "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x (varnish:6)",
                  "product_id": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules-debuginfo@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=s390x\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
                "product": {
                  "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x (varnish:6)",
                  "product_id": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules-debugsource@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=s390x\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
                "product": {
                  "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le (varnish:6)",
                  "product_id": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=ppc64le\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
                "product": {
                  "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le (varnish:6)",
                  "product_id": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-devel@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=ppc64le\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
                "product": {
                  "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le (varnish:6)",
                  "product_id": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-docs@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=ppc64le\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
                "product": {
                  "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le (varnish:6)",
                  "product_id": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=ppc64le\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
                "product": {
                  "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le (varnish:6)",
                  "product_id": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules-debuginfo@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=ppc64le\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
                "product": {
                  "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le (varnish:6)",
                  "product_id": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules-debugsource@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=ppc64le\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
                "product": {
                  "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64 (varnish:6)",
                  "product_id": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=aarch64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
                "product": {
                  "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64 (varnish:6)",
                  "product_id": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-devel@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=aarch64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
                "product": {
                  "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64 (varnish:6)",
                  "product_id": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-docs@6.0.8-2.module%2Bel8.6.0%2B21852%2B17475f6a.3?arch=aarch64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
                "product": {
                  "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64 (varnish:6)",
                  "product_id": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=aarch64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
                "product": {
                  "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64 (varnish:6)",
                  "product_id": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules-debuginfo@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=aarch64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
                "product": {
                  "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64 (varnish:6)",
                  "product_id": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/varnish-modules-debugsource@0.15.0-6.module%2Bel8.5.0%2B11976%2B0b4af72d?arch=aarch64\u0026rpmmod=varnish:6:8060020240520091547:ad008a3a"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6"
        },
        "product_reference": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6"
        },
        "product_reference": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6"
        },
        "product_reference": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src::varnish:6"
        },
        "product_reference": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6"
        },
        "product_reference": "varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6"
        },
        "product_reference": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6"
        },
        "product_reference": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6"
        },
        "product_reference": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6"
        },
        "product_reference": "varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6"
        },
        "product_reference": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6"
        },
        "product_reference": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6"
        },
        "product_reference": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6"
        },
        "product_reference": "varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6"
        },
        "product_reference": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6"
        },
        "product_reference": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6"
        },
        "product_reference": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src::varnish:6"
        },
        "product_reference": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6"
        },
        "product_reference": "varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6"
        },
        "product_reference": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6"
        },
        "product_reference": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6"
        },
        "product_reference": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6"
        },
        "product_reference": "varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6"
        },
        "product_reference": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6"
        },
        "product_reference": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6"
        },
        "product_reference": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64 (varnish:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)",
          "product_id": "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6"
        },
        "product_reference": "varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
        "relates_to_product_reference": "AppStream-8.6.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-30156",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-03-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2271486"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the active HTTP streams, retaining the already allocated resources, leading to resource starvation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "varnish: HTTP/2 Broken Window Attack may result in denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "CVE-2024-30156 represents a important severity issue due to its potential to cause widespread denial of service (DoS) across Varnish Cacher servers with HTTP/2 protocol enabled. By exploiting this vulnerability, attackers can exhaust the server\u0027s HTTP/2 connection control flow window credits, thereby halting the processing of streams and indefinitely retaining associated resources. This can lead to a complete service outage, impacting the availability and performance of web services relying on Varnish Cache. Given the prevalence of HTTP/2 adoption for its performance benefits, the vulnerability poses a significant risk to web infrastructure, necessitating immediate mitigation measures to prevent exploitation and mitigate the impact on affected systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
          "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-30156"
        },
        {
          "category": "external",
          "summary": "RHBZ#2271486",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271486"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-30156",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-30156"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-30156",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30156"
        },
        {
          "category": "external",
          "summary": "https://varnish-cache.org/security/VSV00014.html",
          "url": "https://varnish-cache.org/security/VSV00014.html"
        }
      ],
      "release_date": "2024-03-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-05-28T14:33:18+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:3426"
        },
        {
          "category": "workaround",
          "details": "A possible mitigation for this issue is to disable http2 support until the package can be updated.\nThis can be performed by running the following command:\n\n~~~\nvarnishadm param.set feature -http2\n~~~\n\nNote: you must remove `h2` from the list of protocols if your TLS terminator is advertising it with ALPN.\n\nIt\u0027s also possible to use the `MAIN.sc_bankrupt` counter to monitor possible on-going attacks to the varnish server.",
          "product_ids": [
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.src::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-devel-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-docs-0:6.0.8-2.module+el8.6.0+21852+17475f6a.3.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.src::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debuginfo-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.aarch64::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.ppc64le::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.s390x::varnish:6",
            "AppStream-8.6.0.Z.EUS:varnish-modules-debugsource-0:0.15.0-6.module+el8.5.0+11976+0b4af72d.x86_64::varnish:6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "varnish: HTTP/2 Broken Window Attack may result in denial of service"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.