Inconsistent interpretation of HTTP requests in Varnish Cache - CVE-2022-45059

Vulnerability identifier: #VU69126

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-45059

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers. Among the headers that can be filtered this way are both Content-Length</code> and <code>Host, making it possible for an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL.

Varnish Cache
openEuler
Fedora
varnish-modules
varnish
varnish-help
varnish-debuginfo
varnish-debugsource
varnish-devel

Install updates from vendor's website.

Varnish Cache - addressed in versions 7.1.2, 7.2.1
varnish-modules - update to 0.20.0-4.fc37
varnish - addressed in versions 6.6.2-3.fc35, 7.0.3-2.fc36, 7.1.2-1.fc37
varnish-help - addressed in versions 7.0.1-8, 7.0.1-9
varnish-debuginfo - addressed in versions 7.0.1-8, 7.0.1-9
varnish-debugsource - addressed in versions 7.0.1-8, 7.0.1-9
varnish-devel - addressed in versions 7.0.1-8, 7.0.1-9
varnish - addressed in versions 7.0.1-8, 7.0.1-9

• https://docs.varnish-software.com/security/VSV00010

• Multiple vulnerabilities in Varnish Cache
• openEuler 22.03 LTS SP1 update for varnish
• openEuler 22.03 LTS SP2 update for varnish
• openEuler 22.03 LTS update for varnish
• Fedora 37 update for varnish, varnish-modules
• Fedora 36 update for varnish
• Fedora 35 update for varnish