[arch-security] [ASA-201711-29] varnish: information disclosure

[Morten Linderud]

Arch Linux Security Advisory ASA-201711-29
==========================================

Severity: Medium
Date    : 2017-11-26
CVE-ID  : CVE-2017-8807
Package : varnish
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-502

Summary
=======

The package varnish before version 5.2.1-1 is vulnerable to information
disclosure.

Resolution
==========

Upgrade to 5.2.1-1.

# pacman -Syu "varnish>=5.2.1-1"

The problem has been fixed upstream in version 5.2.1.

Workaround
==========

None.

Description
===========

vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache
4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to
obtain sensitive information from process memory because a
VFP_GetStorage buffer is larger than intended in certain circumstances
involving -sfile Stevedore transient objects.

Impact
======

A remote attacker is able to retrieve sensitive information from the
process memory.

References
==========

https://bugs.archlinux.org/task/56376
https://varnish-cache.org/security/VSV00002.html
https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7
https://github.com/varnishcache/varnish-cache/pull/2429
https://security.archlinux.org/CVE-2017-8807
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20171127/b6043a4f/attachment.asc>