CVE-2019-20637
Fixed in a distro release EPSS 2%
An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.
Products: varnish-cache varnish_cache, varnish-software varnish_cache, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | varnish | 6.4.0-1 |
| Debian 13 | varnish | 6.4.0-1 |
| Red Hat Enterprise Linux 8 | varnish | 0:6.0.6-2.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-devel | 0:6.0.6-2.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-docs | 0:6.0.6-2.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-modules | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-modules-debuginfo | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Red Hat Enterprise Linux 8 | varnish-modules-debugsource | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Rocky Linux 8 | varnish | 0:6.0.6-2.module+el8.3.0+179+20b582cc |
| Rocky Linux 8 | varnish-modules | 0:0.15.0-5.module+el8.3.0+179+20b582cc |
| SUSE Package Hub 15 SP1 | varnish | 6.2.1-bp151.4.6.1 |
| Ubuntu 18.04 LTS | varnish | 5.2.1-1ubuntu0.1 |
| Ubuntu 20.04 LTS | varnish | 6.2.1-2ubuntu0.1 |
| Ubuntu 22.04 LTS | varnish | 6.6.1-1ubuntu0.2 |
| openSUSE Leap 15.1 | varnish | 6.2.1-lp151.3.6.1 |