Vulnerability Description
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Varnish-Cache | Varnish | >= 4.1.0, < 4.1.9 |
| Varnish Cache Project | Varnish Cache | >= 5.0.0, < 5.2.1 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://varnish-cache.org/security/VSV00002.htmlPatchVendor Advisory
- http://www.securityfocus.com/bid/101886Third Party AdvisoryVDB Entry
- https://bugs.debian.org/881808Issue TrackingThird Party Advisory
- https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460cPatchVendor Advisory
- https://github.com/varnishcache/varnish-cache/pull/2429Issue TrackingVendor Advisory
- https://www.debian.org/security/2017/dsa-4034Third Party Advisory
- http://varnish-cache.org/security/VSV00002.htmlPatchVendor Advisory
- http://www.securityfocus.com/bid/101886Third Party AdvisoryVDB Entry
- https://bugs.debian.org/881808Issue TrackingThird Party Advisory
- https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460cPatchVendor Advisory
- https://github.com/varnishcache/varnish-cache/pull/2429Issue TrackingVendor Advisory
- https://www.debian.org/security/2017/dsa-4034Third Party Advisory
FAQ
What is CVE-2017-8807?
CVE-2017-8807 is a vulnerability with a CVSS score of 9.1 (CRITICAL). vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VF...
How severe is CVE-2017-8807?
CVE-2017-8807 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-8807?
Check the references section above for vendor advisories and patch information. Affected products include: Varnish-Cache Varnish, Varnish Cache Project Varnish Cache, Debian Debian Linux.