p PatchFirst

CVE-2022-45060

CVE-2022-45060

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

CVSS 7.5 · High · EPSS 1.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • varnish Debian:12

    Affected ranges
    • ECOSYSTEM: < 7.1.1-1.1

    Update to 7.1.1-1.1

  • varnish Debian:13

    Affected ranges
    • ECOSYSTEM: < 7.1.1-1.1

    Update to 7.1.1-1.1

  • varnish Ubuntu:Pro:18.04:LTS

    Versions
    • 5.0.0-7.1
    • 5.2.1-1
    • 5.2.1-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 5.2.1-1ubuntu0.1+esm1

    Update to 5.2.1-1ubuntu0.1+esm1

  • varnish Ubuntu:Pro:20.04:LTS

    Versions
    • 6.1.1-1
    • 6.2.1-2
    • 6.2.1-2ubuntu0.1~esm1
    • 6.2.1-2ubuntu0.1~esm2
    • 6.2.1-2ubuntu0.1
    • 6.2.1-2ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 6.2.1-2ubuntu0.2+esm1

    Update to 6.2.1-2ubuntu0.2+esm1

  • varnish Ubuntu:Pro:22.04:LTS

    Versions
    • 6.5.2-1
    • 6.6.1-1
    • 6.6.1-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 6.6.1-1ubuntu0.2+esm1

    Update to 6.6.1-1ubuntu0.2+esm1

Original sources

Check your server →