CVE-2017-8807
CriticalSummary
In Varnish HTTP Cache versions 4.1.x before 4.1.9 and 5.x before 5.2.1, a vulnerability allows remote attackers to obtain sensitive information from process memory. This issue arises because a VFP_GetStorage buffer is larger than intended in certain circumstances involving Stevedore transient objects.
Risk Assessment
This vulnerability may lead to the disclosure of sensitive data, posing a serious security threat to the organization. Attackers could exploit this flaw to gain information that may be used in further attacks.
Recommendation
It is recommended to update Varnish HTTP Cache to version 4.1.9 or 5.2.1 to mitigate this vulnerability. Additionally, it is advisable to monitor systems for unauthorized access to process memory.
Original NVD description (English source)
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.