Arch Linux Security Advisory ASA-201711-29

Severity: Medium
Date : 2017-11-26
CVE-ID : CVE-2017-8807
Package : varnish
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-502

Summary

The package varnish before version 5.2.1-1 is vulnerable to information
disclosure.

Resolution

Upgrade to 5.2.1-1.

pacman -Syu “varnish>=5.2.1-1”

The problem has been fixed upstream in version 5.2.1.

Workaround

None.

Description

vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache
4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to
obtain sensitive information from process memory because a
VFP_GetStorage buffer is larger than intended in certain circumstances
involving -sfile Stevedore transient objects.

Impact

A remote attacker is able to retrieve sensitive information from the
process memory.

References

https://bugs.archlinux.org/task/56376
https://varnish-cache.org/security/VSV00002.html
https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7
https://github.com/varnishcache/varnish-cache/pull/2429
https://security.archlinux.org/CVE-2017-8807