Inconsistent interpretation of HTTP requests in Varnish Cache - CVE-2022-23959

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU60291

Inconsistent interpretation of HTTP requests in Varnish Cache - CVE-2022-23959

Published: February 3, 2022


Vulnerability identifier: #VU60291
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-23959
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/1 requests. A remote attacker can send a specially crafted HTTP/1 request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.


Affected software

Varnish Cache
Amazon Linux AMI
Fedora
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
openEuler
Red Hat Software Collections
rh-varnish6-varnish (Red Hat package)
varnish (Debian package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
varnish-modules
varnish
varnish (Ubuntu package)
libvarnishapi1 (Ubuntu package)
varnish-docs
varnish-devel
libvarnishapi2 (Ubuntu package)
varnish-debugsource
varnish-help
varnish-debuginfo

How to mitigate CVE-2022-23959

Install updates from vendor's website.

Varnish Cache - addressed in versions 6.0.10, 6.6.2, 7.0.2
rh-varnish6-varnish (Red Hat package) - update to 6.0.8-2.el7.1
varnish (Debian package) - addressed in versions 6.1.1-1+deb10u3, 6.5.1-1+deb11u2
varnish-modules - update to 0.15.0-6
varnish-modules - update to 0.18.0-5.fc35
varnish - addressed in versions 4.0.5-2.el7, 4.0.5-3.el7, 6.0-3420220128084602.058368ca, 6.0-3520220128084602.f27b74a8, 6.6.2-2.fc35, 7.0.2-1.fc36
varnish - update to 4.0.5-3.23
varnish (Ubuntu package) - addressed in versions 5.2.1-1ubuntu0.1, 6.2.1-2ubuntu0.1, 6.5.2-1ubuntu0.2, 6.6.1-1ubuntu0.2
libvarnishapi1 (Ubuntu package) - update to 5.2.1-1ubuntu0.1
varnish-docs - update to 6.0.8-1
varnish-devel - update to 6.0.8-1
varnish - update to 6.0.8-1
libvarnishapi2 (Ubuntu package) - addressed in versions 6.2.1-2ubuntu0.1, 6.5.2-1ubuntu0.2, 6.6.1-1ubuntu0.2
varnish-debugsource - update to 6.6.2-1
varnish-devel - update to 6.6.2-1
varnish-help - update to 6.6.2-1
varnish-debuginfo - update to 6.6.2-1
varnish - update to 6.6.2-1

External References

Related Security Bulletins