Inconsistent interpretation of HTTP requests in Varnish Cache - CVE-2021-36740

Vulnerability identifier: #VU55501

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-36740

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/2 requests. A remote attacker can send a specially crafted HTTP/2 POST request with a large Content-Length header to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache or bypass VCL authorization.

Varnish Cache
Arch Linux
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Ubuntu
openEuler
Fedora
rh-varnish6-varnish-modules (Red Hat package)
rh-varnish6-varnish (Red Hat package)
varnish (Debian package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
varnish-modules
vmod-uuid
varnish (Ubuntu package)
libvarnishapi1 (Ubuntu package)
varnish
varnish-debuginfo
varnish-debugsource
varnish-devel
varnish-help
varnish-docs
libvarnishapi2 (Ubuntu package)
Red Hat Software Collections

Install updates from vendor's website.

Varnish Cache - addressed in versions 6.0.8, 6.5.2, 6.6.1
rh-varnish6-varnish-modules (Red Hat package) - update to 0.15.0-7.el7
rh-varnish6-varnish (Red Hat package) - update to 6.0.8-2.el7
varnish (Debian package) - addressed in versions 6.1.1-1+deb10u3, 6.5.1-1+deb11u2
varnish-modules - addressed in versions 0.15.0-4, 0.15.0-5
varnish-modules - update to 0.17.1-2.fc34
vmod-uuid - update to 1.8-4.fc34
varnish (Ubuntu package) - addressed in versions 5.2.1-1ubuntu0.1, 6.2.1-2ubuntu0.1, 6.5.2-1ubuntu0.2, 6.6.1-1ubuntu0.2
libvarnishapi1 (Ubuntu package) - update to 5.2.1-1ubuntu0.1
varnish - update to 6.0.0-9
varnish-debuginfo - update to 6.0.0-9
varnish-debugsource - update to 6.0.0-9
varnish-devel - update to 6.0.0-9
varnish-help - update to 6.0.0-9
varnish-docs - addressed in versions 6.0.2-2, 6.0.6-2
varnish-devel - addressed in versions 6.0.2-2, 6.0.6-2
varnish - addressed in versions 6.0.2-2, 6.0.6-2
varnish - addressed in versions 6.0-3320210717084350.601d93de, 6.0-3420210717084350.058368ca, 6.4.0-5.fc33, 6.5.2-1.fc34
libvarnishapi2 (Ubuntu package) - addressed in versions 6.2.1-2ubuntu0.1, 6.5.2-1ubuntu0.2, 6.6.1-1ubuntu0.2
varnish - update to 6.6.1-1

• https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be
• https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf
• https://docs.varnish-software.com/security/VSV00007/
• https://varnish-cache.org/security/VSV00007.html

• HTTP request smuggling in Varnish Cache
• Red Hat Enterprise Linux 8.4 update for varnish
• Red Hat Software Collections update for rh-varnish6-varnish
• Debian update for varnish
• Ubuntu update for varnish
• Arch Linux update for varnish
• openEuler update for varnish
• Fedora 34 update for varnish, varnish-modules, vmod-uuid
• Fedora 33 update for varnish
• Fedora 33 Modular update for varnish
• Fedora 34 Modular update for varnish
• Anolis OS update for varnish:6 (Anolis OS 8.2) module
• Anolis OS update for varnish:6 (Anolis OS 8.4) module