ASA-201711-29 log generated external raw
[ASA-201711-29] varnish: information disclosure |
---|
Arch Linux Security Advisory ASA-201711-29
==========================================
Severity: Medium
Date : 2017-11-26
CVE-ID : CVE-2017-8807
Package : varnish
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-502
Summary
=======
The package varnish before version 5.2.1-1 is vulnerable to information
disclosure.
Resolution
==========
Upgrade to 5.2.1-1.
# pacman -Syu "varnish>=5.2.1-1"
The problem has been fixed upstream in version 5.2.1.
Workaround
==========
None.
Description
===========
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache
4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to
obtain sensitive information from process memory because a
VFP_GetStorage buffer is larger than intended in certain circumstances
involving -sfile Stevedore transient objects.
Impact
======
A remote attacker is able to retrieve sensitive information from the
process memory.
References
==========
https://bugs.archlinux.org/task/56376
https://varnish-cache.org/security/VSV00002.html
https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7
https://github.com/varnishcache/varnish-cache/pull/2429
https://security.archlinux.org/CVE-2017-8807
|