Varnish Cache CVE-2017-8807 Information Disclosure Vulnerability

Bugtraq ID:	101886
Class:	Design Error
CVE:	CVE-2017-8807
Remote:	Yes
Local:	No
Published:	Nov 15 2017 12:00AM
Updated:	Dec 19 2017 10:37PM
Credit:	The vendor reported this issue.
Vulnerable:	Varnish Varnish Cache 5.2 Varnish Varnish Cache 5.1.3 Varnish Varnish Cache 5.1.2 Varnish Varnish Cache 5.1 Varnish Varnish Cache 5.0 Varnish Varnish Cache 4.1.8 Varnish Varnish Cache 4.1.7 Varnish Varnish Cache 4.1.6 Varnish Varnish Cache 4.1.5 Varnish Varnish Cache 4.1.4 Varnish Varnish Cache 4.1.3 Varnish Varnish Cache 4.1.2 Varnish Varnish Cache 4.1.1 Varnish Varnish Cache 4.1.0
Not Vulnerable:	Varnish Varnish Cache 5.2.1 Varnish Varnish Cache 4.1.9

Varnish Cache CVE-2017-8807 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Varnish Cache CVE-2017-8807 Information Disclosure Vulnerability

References:

• Avoid buffer read overflow on vcl_error and -sfile (Varnish)
  
• Bug 1513523 - (CVE-2017-8807) CVE-2017-8807 varnish: Data leak - �??-sfile�?? Steved (Varnish)
  
• CVE-2017-8807 (Red Hat)
  
• DSA-4034-1 varnish -- security update (debian.org)
  
• Varnish Cache Homepage (Varnish Software)
  
• VSV00002 Data leak - �??-sfile�?? Stevedore transient objects (Varnish)