Information disclosure in Varnish Cache - CVE-2019-20637

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.

Affected software

How to mitigate CVE-2019-20637

External References

• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html
• http://varnish-cache.org/security/VSV00004.html#vsv00004

Related Security Bulletins

• Information disclosure in Varnish Cache
• OpenSUSE Linux update for varnish
• OpenSUSE Linux update for varnish
• Red Hat Enterprise Linux 8 update for the varnish:6 module
• Ubuntu update for varnish