Denial-of-Service Vulnerability in Varnish HTTP Cache: CVE-2017-12425
Summary
ALPINE-CVE-2017-12425: An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. Affects varnish versions < 5.1.3-r0. Fixed in 5.1.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Varnish HTTP Cache is a powerful web application accelerator designed to optimize the performance of web servers by caching content. It is widely used to enhance the speed and efficiency of web applications. The package is known for its flexibility and high performance, allowing users to configure caching rules and manage content delivery effectively. However, Varnish has been found to be vulnerable to a Denial-of-Service (DoS) attack due to a flaw in its source code, which can lead to service interruptions.
Vulnerability Detail
An issue was discovered in Varnish HTTP Cache versions 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A faulty if statement in the varnishd source code can trigger an assert when processing certain invalid requests from clients, leading to an Integer Overflow. This vulnerability allows an attacker to crash the varnishd worker process on demand, resulting in a Denial-of-Service condition where the service is unable to serve content. The specific source code file containing the erroneous statement varies across different releases.
How To Fix
Minimum fixed version
5.1.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade varnishTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement rate limiting on incoming requests to mitigate the risk of triggering the vulnerability. This can be done by configuring your web server or using a reverse proxy to limit the number of requests from a single IP address.
Conclusion
CVE-2017-12425 is a significant vulnerability in Varnish HTTP Cache that can lead to Denial-of-Service attacks. It is crucial for users of affected versions to update to the patched version 5.1.3-r0 to ensure the security and reliability of their web applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for varnish →
FAQ
CVE-2017-12425 is a vulnerability in Varnish HTTP Cache that can lead to a Denial-of-Service attack due to an Integer Overflow caused by invalid client requests.
The affected versions include Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check your application for this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
The CVSS score for CVE-2017-12425 is 7.5, indicating a high severity level.
If immediate updating is not possible, consider implementing rate limiting on incoming requests as a workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for varnish.
