CVE-2022-38150
High
Description
In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Varnish Cache
PublishedAug 11, 2022
First seenAug 11, 2022
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2BUKFICLZBXESLQ3MXMIG3G52RZURFK/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW3X4PEKC5C736SCKE2UG3Y7JWKMD2K6/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| varnish_cache_project varnish_cache | 7.0.0, 7.0.1, 7.0.2, 7.1.0 | — |
| fedoraproject fedora | 35, 36 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.