Strix
26.1K

CVE-2017-12425

UnknownEPSS 2.42%

Last modified

CVE-2017-12425 is a vulnerability of currently unknown severity. An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. EPSS estimates a 2.42% chance of exploitation in the next 30 days.

Description

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.

Metrics

EPSS Probability
2.42%

82.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
Varnish-CacheVarnish4.0.2Rc-1
Varnish-CacheVarnish4.0.3Rc-1
Varnish Cache ProjectVarnish Cache4.0.1—
Varnish Cache ProjectVarnish Cache4.0.2—
Varnish Cache ProjectVarnish Cache4.0.3—
Varnish Cache ProjectVarnish Cache4.0.4—
Varnish-CacheVarnish4.1.0—
Varnish-SoftwareVarnish Cache4.1.0Beta1
Varnish-SoftwareVarnish Cache4.1.1—
Varnish-SoftwareVarnish Cache4.1.2—
Varnish-SoftwareVarnish Cache4.1.3—
Varnish-SoftwareVarnish Cache4.1.4—
Varnish-SoftwareVarnish Cache4.1.5—
Varnish-SoftwareVarnish Cache4.1.6—
Varnish-SoftwareVarnish Cache4.1.7—
Varnish Cache ProjectVarnish Cache5.0.0—
Varnish Cache ProjectVarnish Cache5.1.0—
Varnish Cache ProjectVarnish Cache5.1.1—
Varnish Cache ProjectVarnish Cache5.1.2—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-12425?
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.
How severe is CVE-2017-12425?
Severity scoring for CVE-2017-12425 is pending analysis. The EPSS model estimates a 2.42% probability of exploitation in the next 30 days.
How do I fix CVE-2017-12425?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-12425?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST