Candidate: CVE-2017-12425
PublicDate: 2017-08-04 09:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12425
 https://www.varnish-cache.org/security/VSV00001.html#vsv00001
 https://github.com/varnishcache/varnish-cache/issues/2379
 https://lists.debian.org/debian-security-announce/2017/msg00186.html
Description:
 An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0
 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the
 varnishd source code means that particular invalid requests from the client
 can trigger an assert, related to an Integer Overflow. This causes the
 varnishd worker process to abort and restart, losing the cached contents in
 the process. An attacker can therefore crash the varnishd worker process on
 demand and effectively keep it from serving content - a Denial-of-Service
 attack. The specific source-code filename containing the incorrect
 statement varies across releases.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870467
 https://bugzilla.redhat.com/show_bug.cgi?id=1477222
 https://bugzilla.suse.com/show_bug.cgi?id=1051917
 https://bugs.launchpad.net/bugs/1708354
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_varnish:
 upstream: https://github.com/varnishcache/varnish-cache/commit/09731b24b2225e3c0d66d3ec1b4fedef6fa22b6e
 upstream: https://github.com/varnishcache/varnish-cache/commit/54b5a09f00c027da280361b30d32a4ff309ba3ab (only needed on Xenial to fix the i386 build)
upstream_varnish: released (5.0.0-7.1)
precise/esm_varnish: DNE
trusty_varnish: not-affected (code not exposed to clients)
trusty/esm_varnish: not-affected (code not exposed to clients)
vivid/ubuntu-core_varnish: DNE
xenial_varnish: released (4.1.1-1ubuntu0.2)
zesty_varnish: released (5.0.0-7ubuntu0.1)
devel_varnish: not-affected (5.0.0-7.1)