CVE-2017-12425

High

Published: 04/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Varnish HTTP Cache versions 4.0.1 to 4.0.4, 4.1.0 to 4.1.7, 5.0.0, and 5.1.0 to 5.1.2 related to a wrong if statement in the varnishd source code. This bug can lead to an Integer Overflow, causing the varnishd worker process to abort and lose cached content.

Risk Assessment

An attacker can deliberately crash the varnishd worker process, preventing it from serving content and leading to a Denial-of-Service attack. This can significantly impact the availability of services within the organization.

Recommendation

It is recommended to update Varnish HTTP Cache to the latest version to mitigate this vulnerability. Additionally, monitoring server logs for potential attack attempts is advisable.

Other vulnerabilities in Varnish HTTP Cache

CVE-2017-8807Critical
In Varnish HTTP Cache versions 4.1.x before 4.1.9 and 5.x before 5.2.1, a vulnerability allows remote attackers to obtain sensitive information from process memory. This issue arises because a VFP_GetStorage buffer is larger than intended in certain circumstances involving Stevedore transient objects.

Original NVD description (English source)

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.