CVE-2017-12425
Summary
| CVE | CVE-2017-12425 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-08-04 09:29:00 UTC |
| Updated | 2022-08-02 19:13:00 UTC |
| Description | An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases. |
Risk And Classification
Problem Types: CWE-190
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Varnish-cache | Varnish | 4.0.1 | All | All | All |
| Application | Varnish-cache | Varnish | 4.0.2 | All | All | All |
| Application | Varnish-cache | Varnish | 4.0.2 | rc-1 | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | All | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | rc-1 | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | rc-2 | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | rc-2-proper | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | rc-3 | All | All |
| Application | Varnish-cache | Varnish | 4.0.4 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.0 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.0 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.0 | tp-1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.1 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.1 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.1 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.2 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.2 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.2 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.3 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.3 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.3 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.4 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.4 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.4 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.4 | beta3 | All | All |
| Application | Varnish-cache | Varnish | 4.1.5 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.5 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.5 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.6 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.7 | All | All | All |
| Application | Varnish-cache | Varnish | 5.0.0 | All | All | All |
| Application | Varnish-cache | Varnish | 5.1.0 | All | All | All |
| Application | Varnish-cache | Varnish | 5.1.1 | All | All | All |
| Application | Varnish-cache | Varnish | 5.1.2 | All | All | All |
| Application | Varnish-cache | Varnish | 4.0.1 | All | All | All |
| Application | Varnish-cache | Varnish | 4.0.2 | All | All | All |
| Application | Varnish-cache | Varnish | 4.0.2 | rc-1 | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | All | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | rc-1 | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | rc-2 | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | rc-2-proper | All | All |
| Application | Varnish-cache | Varnish | 4.0.3 | rc-3 | All | All |
| Application | Varnish-cache | Varnish | 4.0.4 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.0 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.0 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.0 | tp-1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.1 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.1 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.1 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.2 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.2 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.2 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.3 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.3 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.3 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.4 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.4 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.4 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.4 | beta3 | All | All |
| Application | Varnish-cache | Varnish | 4.1.5 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.5 | beta1 | All | All |
| Application | Varnish-cache | Varnish | 4.1.5 | beta2 | All | All |
| Application | Varnish-cache | Varnish | 4.1.6 | All | All | All |
| Application | Varnish-cache | Varnish | 4.1.7 | All | All | All |
| Application | Varnish-cache | Varnish | 5.0.0 | All | All | All |
| Application | Varnish-cache | Varnish | 5.1.0 | All | All | All |
| Application | Varnish-cache | Varnish | 5.1.1 | All | All | All |
| Application | Varnish-cache | Varnish | 5.1.2 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.0.1 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.0.2 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.0.3 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.0.4 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.0 | beta1 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.1 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.1 | beta1 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.1 | beta2 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.2 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.2 | beta1 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.2 | beta2 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.3 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.3 | beta1 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.3 | beta2 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.4 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.4 | beta1 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.4 | beta2 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.4 | beta3 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.5 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.5 | beta1 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.5 | beta2 | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.6 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 4.1.7 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 5.0.0 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 5.1.0 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 5.1.1 | All | All | All |
| Application | Varnish-cache | Varnish Cache | 5.1.2 | All | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.0 | beta1 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.0 | technology_preview1 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.1 | All | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.1 | beta1 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.1 | beta2 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.2 | All | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.2 | beta1 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.2 | beta2 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.3 | All | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.3 | beta1 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.3 | beta2 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.4 | All | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.4 | beta1 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.4 | beta2 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.4 | beta3 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.5 | All | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.5 | beta1 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.5 | beta2 | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.6 | All | All | All |
| Application | Varnish-software | Varnish Cache | 4.1.7 | All | All | All |
| Application | Varnish Cache Project | Varnish Cache | 4.0.1 | All | All | All |
| Application | Varnish Cache Project | Varnish Cache | 4.0.2 | All | All | All |
| Application | Varnish Cache Project | Varnish Cache | 4.0.3 | All | All | All |
| Application | Varnish Cache Project | Varnish Cache | 4.0.4 | All | All | All |
| Application | Varnish Cache Project | Varnish Cache | 5.0.0 | All | All | All |
| Application | Varnish Cache Project | Varnish Cache | 5.1.0 | All | All | All |
| Application | Varnish Cache Project | Varnish Cache | 5.1.1 | All | All | All |
| Application | Varnish Cache Project | Varnish Cache | 5.1.2 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DSA 3924-1] varnish security update | CONFIRM | lists.debian.org | Mailing List, Third Party Advisory |
| VSV00001 DoS vulnerability — Varnish HTTP Cache | CONFIRM | www.varnish-cache.org | Vendor Advisory |
| 1477222 – (CVE-2017-12425) CVE-2017-12425 varnish: Missing check for integer overflow when handling chunk sizes in HTTP requests | CONFIRM | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| Debian -- Security Information -- DSA-3924-1 varnish | DEBIAN | www.debian.org | |
| Bug 1051917 – VUL-0: varnish: DoS through reachable assert | CONFIRM | bugzilla.suse.com | Issue Tracking, Third Party Advisory |
| Bogusly large chunk sizes may cause assert · Issue #2379 · varnishcache/varnish-cache · GitHub | CONFIRM | github.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.