CVE-2022-45059
High
Description
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Varnish Cache
PublishedNov 9, 2022
First seenNov 9, 2022
Weakness typeCWE-444CWE-444
How to fix
Update
- varnish_cache_project varnish_cache7.1.2 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| varnish_cache_project varnish_cache | 7.0.0 ≤ v < 7.1.2, 7.2.0 | 7.1.2 |
| fedoraproject fedora | 35, 36, 37 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.