PT-2020-10612 · Varnish+6 · Varnish Cache+6

Trygve Tønnesland · Published 2020-04-08 · Updated 2022-08-02 · CVE-2019-20637

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Varnish Cache versions prior to 6.0.5 LTS Varnish Cache versions 6.1.x through 6.2.1 Varnish Cache versions 6.3.x through 6.3.0

Description An issue was discovered in Varnish Cache where it does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.

Recommendations For versions prior to 6.0.5 LTS, update to version 6.0.5 LTS or later. For versions 6.1.x through 6.2.1, update to version 6.2.2 or later. For versions 6.3.x through 6.3.0, update to version 6.3.1 or later.

Fix

Weakness Enumeration

CWE-212

Related Identifiers

CESA-2020_4756

CVE-2019-20637

OPENSUSE-SU-2020:0808-1

OPENSUSE-SU-2020:0819-1

OPENSUSE-SU-2020_0808-1

RHSA-2020:4756

RHSA-2020_4756

RLSA-2020:4756

USN-5474-1

Affected Products

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Varnish Cache

References · 31

• https://osv.dev/vulnerability/RLSA-2020:4756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20637 · Security Note
• https://ubuntu.com/security/CVE-2019-20637 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20637 · Vendor Advisory
• http://varnish-cache.org/security/VSV00004.html#vsv00004 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23959 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20637 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0808-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-20637 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5474-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20637 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5474-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-20637 · Security Note
• https://linux.oracle.com/errata/ELSA-2020-4756.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11653 · Vendor Advisory