CVE-2022-45059
First published: Wed Nov 09 2022(Updated: )
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/varnish | 6.1.1-1+deb10u3 6.1.1-1+deb10u4 6.5.1-1+deb11u3 7.1.1-1.1 | |
| Varnish Cache Project Varnish Cache | >=7.0.0<7.1.2 | |
| Varnish Cache Project Varnish Cache | =7.2.0 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 | |
| >=7.0.0<7.1.2 | ||
| =7.2.0 | ||
| =35 | ||
| =36 | ||
| =37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://varnish-cache.org/security/VSV00010.html
- https://github.com/varnishcache/varnish-cache/commit/fcf5722af75fdbf58dd425dd68d0beaa49bab4f4
- https://security-tracker.debian.org/tracker/CVE-2022-45059
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/
Frequently Asked Questions
What is CVE-2022-45059?
CVE-2022-45059 refers to an issue discovered in Varnish Cache, which allows for a request smuggling attack by manipulating certain headers.
How does CVE-2022-45059 affect Varnish Cache servers?
CVE-2022-45059 affects Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1, allowing for request smuggling attacks that prevent critical headers from being forwarded to the backend.
What is the severity of CVE-2022-45059?
The severity of CVE-2022-45059 is high, with a severity value of 7.5.
Which software versions are affected by CVE-2022-45059?
Varnish Cache 7.x versions before 7.1.2 and 7.2.x versions before 7.2.1 are affected by CVE-2022-45059.
How can CVE-2022-45059 be mitigated?
To mitigate CVE-2022-45059, upgrade Varnish Cache to version 7.1.2 or 7.2.1.
- collector/security-tracker-debian
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- package-manager/debian
- vendor/varnish cache project
- canonical/varnish cache project varnish cache
- version/varnish cache project varnish cache/7.0.0
- version/varnish cache project varnish cache/7.2.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37