Integer Overflow Vulnerability in Varnish HTTP Cache
Summary
CVE-2017-12425: An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. Affects varnish across 29 version ranges.
< 0d7404e06902a3ccb087adab1bd39760e2e7038e
< 1f6e7cd467ccbfb2fb9e4817e92cdbf9462e274c
< 2c82b1c9d7f01fea89a8f94003eee94e8a305509
< 5.1.3-r0
< 5ba741bab7af3d2d2bdc3e8ab0547d201541d256
< 5e3b6d281c158fc2ac86528777497b3c4cb0ec4b
< 6ece695868b71d47c5a3619e18c3b18792bfe149
< 8a2dfefef4ac14989666a5f42aa7e78e656fa59b
< 9dc2ec53e232cb230dcd3673c80bb8f3420313ee
< 32af38d43c9cefa10ef24775ef999fbd61fd49ed
< 47df80469a2846b56075e3b01a3dd26243cb01ba
< 48fa5da61216210b98a0c1f9fc3461d2a883305f
< 51ba68f304a3c65140b6a506c7c6fd19aa245e71
< 51cbf502ef5d365104df032f2e104830c82e77a3
< 66bb824548c32e588affe203ea8033430fea2da1
< 99d036fe0b49c7487edb7dfd0da10fc2eef30505
< 245ec6c2f17263f6772c7b7d220da81f8c869e93
< 386f7124f948b87ebb518a249f0e67d95e64e89e
< 876f54190c89329e209d6e8acb56d455b1fe0a42
< 1628f0b93e4ba725f2f26ca82a6e794229517475
< 4354e5e04a6af43394bbbdb32dc2654ca4887de8
< 4529ff74ca96b2eb9a58f64e6cae80f34ff33142
< 47861b9eb052ab547fce414cd9cfcf917d495419
< 3041728c596139834b789c424ad886306f30334c
< b8c4a34f5d8aacb955d989a606a04ca52caf835e
< bfe7cd198d07ab2197f7d178b08df0caa5e6b7a3
< ce824e24df695d73060e8bb6693992c93640b32e
< de38712a7c8be1ea26caf4e7392814f34c44275e
< e77e315c32be15c22c3e82226d8f06828aee59ce
Fixed in 5.1.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Varnish HTTP Cache is an open-source web application accelerator designed to improve the performance of dynamic websites. It acts as a reverse proxy and caches content to reduce server load and improve response times. This vulnerability affects Varnish versions 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12425, stems from a wrong if statement in the varnishd source code. This flaw allows certain invalid requests from clients to trigger an assert, resulting in an Integer Overflow. As a consequence, the varnishd worker process crashes and restarts, leading to the loss of cached contents. An attacker can exploit this vulnerability to launch a Denial-of-Service (DoS) attack, effectively preventing the varnishd worker process from serving content.
How To Fix
Minimum fixed version
5.1.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade varnishTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The Integer Overflow vulnerability in Varnish HTTP Cache can be exploited by attackers to launch a Denial-of-Service (DoS) attack. It is crucial to update Varnish to version 5.1.3-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for varnish →
FAQ
Varnish HTTP Cache is an open-source web application accelerator that improves the performance of dynamic websites by caching content and reducing server load.
Varnish versions 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2 are affected by this vulnerability.
This vulnerability allows an attacker to crash the varnishd worker process, resulting in a Denial-of-Service (DoS) attack and the loss of cached contents.
To fix this vulnerability, update Varnish to version 5.1.3-r0 or later.
No workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for varnish.
