CVE-2022-23959
First published: Wed Jan 26 2022(Updated: )
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/varnish | 6.1.1-1+deb10u3 6.1.1-1+deb10u4 6.5.1-1+deb11u3 7.1.1-1.1 | |
| debian/varnish | <=6.5.1-1<=6.1.1-1+deb10u1<=6.1.1-1<=6.6.1-1 | 7.1.0-5 6.1.1-1+deb10u3 6.5.1-1+deb11u2 7.1.0-4 |
| Varnish-software Varnich Cache | >=1.0.0<6.6.2 | |
| Varnish-software Varnich Cache | >=4.1.1<4.1.11r6 | |
| Varnish-software Varnich Cache | =4.1 | |
| Varnish-software Varnish Cache | >=6.0.0<6.0.10 | |
| Varnish-software Varnish Cache Plus | >=6.0.0<6.0.9r4 | |
| Varnish Cache Project Varnish Cache | >=7.0.0<7.0.2 | |
| Fedoraproject Fedora | =35 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://varnish-cache.org/security/VSV00008.html
- https://docs.varnish-software.com/security/VSV00008/
- https://github.com/varnishcache/varnish-cache/commit/fceaefd4d59a3b5d5a4903a3f420e35eb430d0d4
- https://github.com/varnishcache/varnish-cache/commit/9ed39d1f796369caafb647fe37b729c07f332327
- https://github.com/varnishcache/varnish-cache/commit/ec531e16b9cd139bbf8971c5b306561c669681f4
- https://security-tracker.debian.org/tracker/CVE-2022-23959
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23959
- https://nvd.nist.gov/vuln/detail/CVE-2022-23959
- http://cwe.mitre.org/data/definitions/444.html
- https://github.com/varnishcache/varnish-cache/commit/1020be7e886399a4e94407ae0dfbfd1475cc5756
- https://github.com/varnishcache/varnish-cache/commit/dcbe8b9ebf5b352e2534fc5645afa1d9747e9647
- https://github.com/varnishcache/varnish-cache/commit/b8351f7f6231315f0fe00410b91893235eb29f57
- https://security-tracker.debian.org/tracker/CVE-2021-36740
- https://people.debian.org/~carnil/tmp/varnish/
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004433
- https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/
- https://www.debian.org/security/2022/dsa-5088
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/
Frequently Asked Questions
What is CVE-2022-23959?
CVE-2022-23959 is a vulnerability in Varnish Cache that allows request smuggling for HTTP/1 connections.
What is the severity of CVE-2022-23959?
CVE-2022-23959 has a severity level of critical (9.1).
How can request smuggling occur in Varnish Cache?
Request smuggling can occur in Varnish Cache due to a vulnerability in versions before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4.
Which software versions are affected by CVE-2022-23959?
CVE-2022-23959 affects Varnish Cache versions before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4.
How can I fix CVE-2022-23959?
To fix CVE-2022-23959, it is recommended to upgrade to Varnish Cache 6.6.2 or 7.x 7.0.2, Varnish Cache 6.0 LTS 6.0.10, or Varnish Enterprise (Cache Plus) 4.1.x 4.1.11r6 or 6.0.x 6.0.9r4.
- collector/security-tracker-debian
- collector/debian-bugs
- alias/CVE-2022-23959
- agent/author
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- agent/weakness
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/varnish-software
- canonical/varnish-software varnich cache
- version/varnish-software varnich cache/1.0.0
- version/varnish-software varnich cache/4.1.1
- version/varnish-software varnich cache/4.1
- canonical/varnish-software varnish cache
- version/varnish-software varnish cache/6.0.0
- canonical/varnish-software varnish cache plus
- version/varnish-software varnish cache plus/6.0.0
- vendor/varnish cache project
- canonical/varnish cache project varnish cache
- version/varnish cache project varnish cache/7.0.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- version/debian debian linux/11.0