SB2022111748 - Fedora 35 update for varnish
Published: November 17, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Reachable Assertion (CVE-ID: CVE-2022-38150)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion when processing HTTP/1 responses from configured backends. A remote attacker with ability to influence server response can pass specially crafted reason phrase of the backend response status line and perform a denial of service (DoS) attack.
2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2022-45059)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers. Among the headers that can be filtered this way are both Content-Length</code> and <code>Host, making it possible for an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL.
3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2022-45060)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input when handling HTTP/2 requests. A remote attacker can introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend.
Remediation
Install update from vendor's website.