Bug 1772362 (CVE-2019-20637)

Summary:	CVE-2019-20637 varnish: not clearing pointer between two client requests leads to information disclosure
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	hhorak, ingvar, jorton, luhliari, mkaplan
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	varnish 6.3.1, varnish 6.2.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 02:23:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1772363, 1790907, 1790920, 1790921
Bug Blocks:	1772366, 1813873

Description Marian Rehak 2019-11-14 09:09:21 UTC

A bug has been discovered in Varnish Cache where we fail to clear a pointer between the handling of one client requests and the next on the same connection. This can under specific circumstances lead to information being leaked from the connection workspace.

Upstream Reference:

http://varnish-cache.org/security/VSV00004.html#vsv00004

Comment 1 Marian Rehak 2019-11-14 09:14:48 UTC

Created varnish tracking bugs for this issue:

Affects: fedora-all [bug 1772363]

Comment 4 Marco Benatto 2020-01-14 14:41:16 UTC

Upstream commit for this issue:

https://github.com/varnishcache/varnish-cache/commit/bd7b3d6d47ccbb5e1747126f8e2a297f38e56b8c

Comment 5 Ingvar Hagelund 2020-02-24 09:56:22 UTC

VSV00004 was fixed in rawhide 2019-10-22.

f29
Submitted: 2019-10-22
Testing:   2010-10-25
Stable:    2019-11-02

f30
Submitted: 2019-10-22
Testing:   2010-10-25
Stable:    2019-11-03

f31
Submitted: 2019-10-22
Testing:   2010-10-23
Stable:    2019-10-31

Comment 6 Marian Rehak 2020-03-17 09:25:44 UTC

*** Bug 1813877 has been marked as a duplicate of this bug. ***

Comment 7 Doran Moppert 2020-04-01 09:12:55 UTC

Please do not close Security Response / vulnerability bugs, the Fedora tracking bug 1772363 is the correct one to track Fedora updates.

Comment 9 Product Security DevOps Team 2020-11-04 02:23:13 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-20637

Comment 10 errata-xmlrpc 2020-11-04 03:37:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4756 https://access.redhat.com/errata/RHSA-2020:4756