Vulnerability · Published Nov 9, 2022 · Assigned by mitre
CVE-2022-45060
High 7.5
In plain English
A high-severity improper input validation in the varnish package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | varnish | 6.0.8-2.module_el8.7.0+3353+b11d8f2f.1 | ALSA-2022:8649 |
| AlmaLinux:9 | varnish | 6.6.2-2.el9_1.1 | ALSA-2022:8643 |
| AlmaLinux:8 | varnish-devel | 6.0.8-2.module_el8.7.0+3353+b11d8f2f.1 | ALSA-2022:8649 |
| AlmaLinux:9 | varnish-devel | 6.6.2-2.el9_1.1 | ALSA-2022:8643 |
| AlmaLinux:8 | varnish-docs | 6.0.8-2.module_el8.7.0+3353+b11d8f2f.1 | ALSA-2022:8649 |
| AlmaLinux:9 | varnish-docs | 6.6.2-2.el9_1.1 | ALSA-2022:8643 |
| AlmaLinux:8 | varnish-modules | 0.15.0-6.module_el8.5.0+2620+03a0c2cc | ALSA-2022:8649 |
| AlmaLinux:8 | varnish-modules | 0.15.0-6.module_el8.5.0+76+a10ffa55 | ALSA-2022:8649 |
| AlmaLinux:8 | varnish-modules | 0.15.0-6.module_el8.6.0+3089+dac88e97 | ALSA-2022:8649 |
| Alpine:v3.20 | varnish | 7.2.1-r0 | ALPINE-CVE-2022-45060 |
| Alpine:v3.21 | varnish | 7.2.1-r0 | ALPINE-CVE-2022-45060 |
| Alpine:v3.22 | varnish | 7.2.1-r0 | ALPINE-CVE-2022-45060 |
| Alpine:v3.23 | varnish | 7.2.1-r0 | ALPINE-CVE-2022-45060 |
| Alpine:v3.24 | varnish | 7.2.1-r0 | ALPINE-CVE-2022-45060 |
| Debian:12 | varnish | 7.1.1-1.1 | DEBIAN-CVE-2022-45060 |
| Debian:13 | varnish | 7.1.1-1.1 | DEBIAN-CVE-2022-45060 |
| Rocky Linux:8 | varnish | 0:6.0.8-2.module+el8.7.0+1094+66cdd070.1 | RLSA-2022:8649 |
| Rocky Linux:9 | varnish | 0:6.6.2-2.el9_1.1 | RLSA-2022:8643 |
| Rocky Linux:8 | varnish-modules | 0:0.15.0-6.module+el8.5.0+677+2a78a869 | RLSA-2022:8649 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://varnish-cache.org/security/VSV00011.html
- https://docs.varnish-software.com/security/VSV00011
- FEDORA-2022-babfbc2622 vendor-advisory
- FEDORA-2022-0d5dcc031e vendor-advisory
- FEDORA-2022-99c5ddb2ae vendor-advisory
- [debian-lts-announce] 20221127 [SECURITY] [DLA 3208-1] varnish security update mailing-list
- DSA-5334 vendor-advisory