#VU30309 Information disclosure in Varnish Cache - CVE-2019-20637

Vulnerability identifier: #VU30309

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-20637

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Varnish Cache
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Varnish Software

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Varnish Cache: 6.0.0 - 6.0.4

---

External links
https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html
https://varnish-cache.org/security/VSV00004.html#vsv00004

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.