CVE-2023-41104
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure.
Risk Assessment
Organizations may be exposed to unauthorized access to systems and leakage of sensitive data, depending on the specific VCL configuration.
Recommendation
It is recommended to update libvmod-digest to version 1.0.3 or later and review the VCL configuration to minimize risk.
Original NVD description (English source)
libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.