CVE-2017-8807: falha em Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x…
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 4.1%
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
Produtos afetados
n/a · Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1Referências
https://bugs.debian.org/881808https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7https://github.com/varnishcache/varnish-cache/pull/2429https://www.debian.org/security/2017/dsa-4034http://varnish-cache.org/security/VSV00002.htmlhttp://www.securityfocus.com/bid/101886