CVE search · CVE-2019-20637
CVE-2019-20637
high 7.5
An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-212
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- varnish-cache · varnish_cache
- varnish-software · varnish_cache
- opensuse · backports_sle
- opensuse · leap
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.htmlMailing ListThird Party Advisory
- http://varnish-cache.org/security/VSV00004.html#vsv00004Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.htmlMailing ListThird Party Advisory
- http://varnish-cache.org/security/VSV00004.html#vsv00004Vendor Advisory