Upstream has issued an advisory today (November 15): https://varnish-cache.org/security/VSV00002.html Debian has issued an advisory for this today: https://www.debian.org/security/2017/dsa-4034 The issue is fixed in 5.2.1 and Debian has a patch for 5.0.0. Mageia 6 is also affected.
Whiteboard: (none) => MGA6TOO
Assigning to all packagers collectively, since there is no registered maintainer for this package.
Assignee: bugsquad => pkg-bugsCC: (none) => geiger.david68210, mageia, marja11
Suggested advisory: ======================== The updated packages fix a security vulnerability: vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects. (CVE-2017-8807) References: https://varnish-cache.org/security/VSV00002.html https://www.debian.org/security/2017/dsa-4034 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8807 ======================== Updated packages in 6/core/updates_testing: ======================== varnish-5.0.0-3.2.mga6 lib(64)varnish1-5.0.0-3.2.mga6 lib(64)varnish-devel-5.0.0-3.2.mga6 from SRPMS: varnish-5.0.0-3.2.mga6.src.rpm
CC: (none) => nicolas.salgueroStatus: NEW => ASSIGNEDVersion: Cauldron => 6Assignee: pkg-bugs => qa-bugsWhiteboard: MGA6TOO => (none)
Source RPM: varnish-5.0.0-4.mga7.src.rpm => varnish-5.0.0-3.1.mga6.src.rpm
In VirtualBox, M8, Plasma, 64-bit Package(s) under test: varnish lib64varnish1 default install of varnish & lib64varnish1 [root@localhost wilcal]# urpmi varnish Package varnish-5.0.0-3.1.mga6.x86_64 is already installed [root@localhost wilcal]# urpmi lib64varnish1 Package lib64varnish1-5.0.0-3.1.mga6.x86_64 is already installed Test procedure here: https://bugs.mageia.org/show_bug.cgi?id=18244#c2 [root@localhost wilcal]# systemctl start varnish.service [root@localhost wilcal]# systemctl status -l varnish.service ● varnish.service - Varnish a high-perfomance HTTP accelerator Loaded: loaded (/usr/lib/systemd/system/varnish.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2017-11-29 11:44:11 PST; 12s ago Process: 5158 ExecStart=/usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a ${ADDRESS}:${PORT} -T 127.0.0.1 Main PID: 5169 (varnishd) CGroup: /system.slice/varnish.service ├─5169 /usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a :6081 -T 127.0.0.1:6082 -t 120 -W epoll └─5170 /usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a :6081 -T 127.0.0.1:6082 -t 120 -W epoll Nov 29 11:44:11 localhost systemd[1]: Starting Varnish a high-perfomance HTTP accelerator... Nov 29 11:44:11 localhost systemd[1]: varnish.service: Failed to read PID from file /run/varnish/varnish.pid: Invalid argument Nov 29 11:44:11 localhost varnishd[5169]: Platform: Linux,4.9.56-desktop-1.mga6,x86_64,-jnone,-sfile,-smalloc,-hcritbit Nov 29 11:44:11 localhost varnishd[5169]: Child (5170) Started Nov 29 11:44:11 localhost systemd[1]: Started Varnish a high-perfomance HTTP accelerator. Nov 29 11:44:11 localhost varnishd[5169]: Child (5170) said Child starts Nov 29 11:44:11 localhost varnishd[5169]: Child (5170) said SMF.s0 mmap'ed 1073741824 bytes of 1073741824 [1]+ Stopped systemctl status -l varnish.service [root@localhost wilcal]# systemctl status -l varnishncsa.service ● varnishncsa.service - Varnish NCSA logging Loaded: loaded (/usr/lib/systemd/system/varnishncsa.service; enabled; vendor preset: enabled) Active: inactive (dead) [root@localhost wilcal]# varnishadm status Child in state running [root@localhost wilcal]# varnishadm backend.list Backend name Admin Probe Last updated boot.default probe Healthy (no probe) Wed, 29 Nov 2017 19:44:11 GMT [root@localhost wilcal]# varnishadm banner ----------------------------- Varnish Cache CLI 1.0 ----------------------------- Linux,4.9.56-desktop-1.mga6,x86_64,-jnone,-sfile,-smalloc,-hcritbit varnish-5.0.0 revision 99d036f Type 'help' for command list. Type 'quit' to close CLI session. ******************** end initial test responds as expected ******************** install varnish & lib64varnish1 from updates_testing [root@localhost wilcal]# urpmi varnish Package varnish-5.0.0-3.2.mga6.x86_64 is already installed [root@localhost wilcal]# urpmi lib64varnish1 Package lib64varnish1-5.0.0-3.2.mga6.x86_64 is already installed [root@localhost wilcal]# systemctl stop varnish.service [root@localhost wilcal]# systemctl start varnish.service [root@localhost wilcal]# systemctl status -l varnish.service ● varnish.service - Varnish a high-perfomance HTTP accelerator Loaded: loaded (/usr/lib/systemd/system/varnish.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2017-11-29 11:54:36 PST; 20s ago Process: 7324 ExecStart=/usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a ${ADDRESS}:${PORT} Main PID: 7334 (varnishd) CGroup: /system.slice/varnish.service ├─7334 /usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a :6081 -T 127.0.0.1:6082 -t └─7335 /usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a :6081 -T 127.0.0.1:6082 -t Nov 29 11:54:36 localhost systemd[1]: Starting Varnish a high-perfomance HTTP accelerator... Nov 29 11:54:36 localhost systemd[1]: varnish.service: Failed to read PID from file /run/varnish/varnish.pid: Invalid argu Nov 29 11:54:36 localhost varnishd[7334]: Platform: Linux,4.9.56-desktop-1.mga6,x86_64,-jnone,-sfile,-smalloc,-hcritbit Nov 29 11:54:36 localhost varnishd[7334]: Child (7335) Started Nov 29 11:54:36 localhost systemd[1]: Started Varnish a high-perfomance HTTP accelerator. Nov 29 11:54:36 localhost varnishd[7334]: Child (7335) said Child starts Nov 29 11:54:36 localhost varnishd[7334]: Child (7335) said SMF.s0 mmap'ed 1073741824 bytes of 1073741824 lines 1-16/16 (END) [1]+ Stopped systemctl status -l varnish.service [root@localhost wilcal]# systemctl status -l varnishncsa.service ● varnishncsa.service - Varnish NCSA logging Loaded: loaded (/usr/lib/systemd/system/varnishncsa.service; enabled; vendor preset: enabled) Active: inactive (dead) [root@localhost wilcal]# varnishadm status Child in state running [root@localhost wilcal]# varnishadm backend.list Backend name Admin Probe Last updated boot.default probe Healthy (no probe) Wed, 29 Nov 2017 19:54:36 GMT [root@localhost wilcal]# varnishadm banner ----------------------------- Varnish Cache CLI 1.0 ----------------------------- Linux,4.9.56-desktop-1.mga6,x86_64,-jnone,-sfile,-smalloc,-hcritbit varnish-5.0.0 revision 99d036f Type 'help' for command list. Type 'quit' to close CLI session. ********* No errors *********
CC: (none) => wilcal.int
Whiteboard: (none) => MGA6-64-OK
In VirtualBox, M6, Plasma, 32-bit Package(s) under test: varnish libvarnish1 libvarnish-devel default install of varnish libvarnish1 & libvarnish-devel [root@localhost wilcal]# urpmi varnish Package varnish-5.0.0-3.1.mga6.i586 is already installed [root@localhost wilcal]# urpmi libvarnish1 Package libvarnish1-5.0.0-3.1.mga6.i586 is already installed [root@localhost wilcal]# urpmi libvarnish-devel Package libvarnish-devel-5.0.0-3.1.mga6.i586 is already installed [root@localhost wilcal]# systemctl start varnish.service [root@localhost wilcal]# systemctl status -l varnish.service ● varnish.service - Varnish a high-perfomance HTTP accelerator Loaded: loaded (/usr/lib/systemd/system/varnish.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2017-11-29 12:10:50 PST; 8s ago Process: 8955 ExecStart=/usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a ${ADDRESS}:${PORT} -T 127.0.0.1:6 Main PID: 8965 (varnishd) CGroup: /system.slice/varnish.service ├─8965 /usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a :6081 -T 127.0.0.1:6082 -t 120 -W epoll - └─8966 /usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a :6081 -T 127.0.0.1:6082 -t 120 -W epoll - Nov 29 12:10:50 localhost systemd[1]: Starting Varnish a high-perfomance HTTP accelerator... Nov 29 12:10:50 localhost systemd[1]: varnish.service: Failed to read PID from file /run/varnish/varnish.pid: Invalid argument Nov 29 12:10:50 localhost varnishd[8965]: Platform: Linux,4.9.56-desktop-1.mga6,i686,-jnone,-sfile,-smalloc,-hcritbit Nov 29 12:10:50 localhost varnishd[8965]: Child (8966) Started Nov 29 12:10:50 localhost systemd[1]: Started Varnish a high-perfomance HTTP accelerator. Nov 29 12:10:51 localhost varnishd[8965]: Child (8966) said Child starts Nov 29 12:10:51 localhost varnishd[8965]: Child (8966) said SMF.s0 mmap'ed 1073741824 bytes of 1073741824 [1]+ Stopped systemctl status -l varnish.service [root@localhost wilcal]# systemctl status -l varnishncsa.service ● varnishncsa.service - Varnish NCSA logging Loaded: loaded (/usr/lib/systemd/system/varnishncsa.service; enabled; vendor preset: enabled) Active: inactive (dead) [root@localhost wilcal]# varnishadm status Child in state running [root@localhost wilcal]# varnishadm banner ----------------------------- Varnish Cache CLI 1.0 ----------------------------- Linux,4.9.56-desktop-1.mga6,i686,-jnone,-sfile,-smalloc,-hcritbit varnish-5.0.0 revision 99d036f Type 'help' for command list. Type 'quit' to close CLI session. ******************** end initial test responds as expected ******************** install varnish libvarnish1 & libvarnish-devel from updates_testing [root@localhost wilcal]# urpmi varnish Package varnish-5.0.0-3.2.mga6.i586 is already installed [root@localhost wilcal]# urpmi libvarnish1 Package libvarnish1-5.0.0-3.2.mga6.i586 is already installed [root@localhost wilcal]# urpmi libvarnish-devel Package libvarnish-devel-5.0.0-3.2.mga6.i586 is already installed [root@localhost wilcal]# systemctl stop varnish.service [root@localhost wilcal]# systemctl start varnish.service [root@localhost wilcal]# systemctl status -l varnish.service ● varnish.service - Varnish a high-perfomance HTTP accelerator Loaded: loaded (/usr/lib/systemd/system/varnish.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2017-11-29 12:15:59 PST; 6s ago Process: 11379 ExecStart=/usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a ${ADDRESS}:${PORT} -T 127.0.0.1:6 Main PID: 11390 (varnishd) CGroup: /system.slice/varnish.service ├─11390 /usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a :6081 -T 127.0.0.1:6082 -t 120 -W epoll - └─11391 /usr/sbin/varnishd -P /run/varnish/varnish.pid -f /etc/varnish/default.vcl -a :6081 -T 127.0.0.1:6082 -t 120 -W epoll - Nov 29 12:15:59 localhost systemd[1]: Starting Varnish a high-perfomance HTTP accelerator... Nov 29 12:15:59 localhost systemd[1]: varnish.service: Failed to read PID from file /run/varnish/varnish.pid: Invalid argument Nov 29 12:15:59 localhost varnishd[11390]: Platform: Linux,4.9.56-desktop-1.mga6,i686,-jnone,-sfile,-smalloc,-hcritbit Nov 29 12:15:59 localhost varnishd[11390]: Child (11391) Started Nov 29 12:15:59 localhost systemd[1]: Started Varnish a high-perfomance HTTP accelerator. Nov 29 12:16:00 localhost varnishd[11390]: Child (11391) said Child starts Nov 29 12:16:00 localhost varnishd[11390]: Child (11391) said SMF.s0 mmap'ed 1073741824 bytes of 1073741824 lines 1-16/16 (END) [1]+ Stopped systemctl status -l varnish.service [root@localhost wilcal]# systemctl status -l varnishncsa.service ● varnishncsa.service - Varnish NCSA logging Loaded: loaded (/usr/lib/systemd/system/varnishncsa.service; enabled; vendor preset: enabled) Active: inactive (dead) [root@localhost wilcal]# varnishadm status Child in state running [root@localhost wilcal]# varnishadm backend.list Backend name Admin Probe Last updated boot.default probe Healthy (no probe) Wed, 29 Nov 2017 20:16:00 GMT [root@localhost wilcal]# varnishadm banner ----------------------------- Varnish Cache CLI 1.0 ----------------------------- Linux,4.9.56-desktop-1.mga6,i686,-jnone,-sfile,-smalloc,-hcritbit varnish-5.0.0 revision 99d036f Type 'help' for command list. Type 'quit' to close CLI session. ********* No errors *********
Whiteboard: MGA6-64-OK => MGA6-32-OK MGA6-64-OK
This update works fine. Testing complete for MGA6, 32-bit & 64-bit Validating the update. Could someone from the sysadmin team push to updates. Thanks
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Thanks Bill for doing this one. Advisory uploaded.
Keywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2017-0435.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED