varnish: CVE-2022-45060: VSV00011 Varnish HTTP/2 Request Forgery Vulnerability

Debian Bug report logs - #1023751
varnish: CVE-2022-45060: VSV00011 Varnish HTTP/2 Request Forgery Vulnerability

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: varnish: CVE-2022-45060: VSV00011 Varnish HTTP/2 Request Forgery Vulnerability

Date: Wed, 09 Nov 2022 16:09:53 +0100

Source: varnish
Version: 7.1.1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 6.5.1-1+deb11u2
Control: found -1 6.5.1-1

Hi,

The following vulnerability was published for varnish.

CVE-2022-45060[0]:
| An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and
| 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An
| attacker may introduce characters through HTTP/2 pseudo-headers that
| are invalid in the context of an HTTP/1 request line, causing the
| Varnish server to produce invalid HTTP/1 requests to the backend. This
| could, in turn, be used to exploit vulnerabilities in a server behind
| the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is
| affected.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-45060
    https://www.cve.org/CVERecord?id=CVE-2022-45060
[1] https://varnish-cache.org/security/VSV00011.html
[2] https://github.com/varnishcache/varnish-cache/commit/515a93df894430767073ccd8265497b6b25b54b5

Regards,
Salvatore

Send a report that this bug log contains spam.