CVE-2017-12425

    Dashboard / Vulnerabilities / CVE-2017-12425

    CVE-2017-12425

    Published: 4 Aug 2017Last Modified: 8 Jul 2026

    Summary:

    Details: An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.

    References: http://www.debian.org/security/2017/dsa-3924, https://github.com/varnishcache/varnish-cache/issues/2379, https://lists.debian.org/debian-security-announce/2017/msg00186.html, https://www.varnish-cache.org/security/VSV00001.html#vsv00001, https://bugzilla.redhat.com/show_bug.cgi?id=1477222, https://bugzilla.suse.com/show_bug.cgi?id=1051917

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4354e5e04a6af43394bbbdb32dc2654ca4887de8
    Fixed -None

    Affected versions

    4.0.1
    4.0.2
    4.0.3
    4.0.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High