Skip to content
Fencer Intel
high 7.5

CVE-2019-20637 json

An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1.

published 6y ago modified 4mo ago also EUVD-2019-11176

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.

Patch / fix

  • varnish-cache varnish_cache 6.2.2, 6.3.1
  • varnish-software varnish_cache 6.0.5
  • varnish Debian 13, Debian 12 6.4.0-1

debian advisories DEBIAN-CVE-2019-20637

  • varnish Ubuntu 18.04 LTS 5.2.1-1ubuntu0.1
  • varnish Ubuntu 20.04 LTS 6.2.1-2ubuntu0.1

ubuntu advisories UBUNTU-CVE-2019-20637

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • varnish RHEL 8 6.0.6-2.module+el8.3.0+6843+b3b42fcc
  • varnish-modules RHEL 8 0.15.0-5.module+el8.3.0+6843+b3b42fcc

red hat advisories RHSA-2020:4756

  • varnish Package Hub 15 SP1 6.2.1-bp151.4.6.1
  • varnish openSUSE Leap 15.1 6.2.1-lp151.3.6.1

opensuse advisories openSUSE-SU-2020:0819-1openSUSE-SU-2020:0808-1

  • varnish Rocky Linux 8 6.0.6-2.module+el8.3.0+179+20b582cc
  • varnish-modules Rocky Linux 8 0.15.0-5.module+el8.3.0+179+20b582cc

rocky linux advisories RLSA-2020:4756

Is CVE-2019-20637 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-20637 updated cvss 3.1

varnish: not clearing pointer between two client requests leads to information disclosure

  • Red Hat Software Collections rh-varnish5-varnish, rh-varnish6-varnish, rh-varnish5-varnish-libs, rh-varnish6-varnish-libs
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 8) varnish 6.0.6-2.module+el8.3.0+6843+b3b42fcc, varnish-modules 0.15.0-5.module+el8.3.0+6843+b3b42fcc
    fixed: vendor fix RHSA-2020:4756

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.