Vulnerability · Published Aug 11, 2022 · Assigned by mitre
CVE-2022-38150
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in the varnish package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.5%top 25.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | varnish | 7.0.3-r0 | ALPINE-CVE-2022-38150 |
| Alpine:v3.21 | varnish | 7.0.3-r0 | ALPINE-CVE-2022-38150 |
| Alpine:v3.22 | varnish | 7.0.3-r0 | ALPINE-CVE-2022-38150 |
| Alpine:v3.23 | varnish | 7.0.3-r0 | ALPINE-CVE-2022-38150 |
| Alpine:v3.24 | varnish | 7.0.3-r0 | ALPINE-CVE-2022-38150 |
| Debian:12 | varnish | 7.1.1-1 | DEBIAN-CVE-2022-38150 |
| Debian:13 | varnish | 7.1.1-1 | DEBIAN-CVE-2022-38150 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://varnish-cache.org/security/VSV00009.html
- FEDORA-2022-1fa6d1ed2f vendor-advisory
- FEDORA-2022-99702d9bdd vendor-advisory
- FEDORA-2022-99c5ddb2ae vendor-advisory