In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
References
Link | Resource |
---|---|
https://docs.varnish-software.com/security/VSV00008/ | Mitigation Vendor Advisory |
https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/ | |
https://varnish-cache.org/security/VSV00008.html | Mitigation Vendor Advisory |
https://www.debian.org/security/2022/dsa-5088 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
07 Nov 2023, 03:44
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
02 Aug 2022, 19:35
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:* cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:lts:*:*:* cpe:2.3:a:varnish-software:varnish_cache_plus:*:*:*:*:*:*:*:* |
|
First Time |
Varnish-software varnish Cache Plus
Varnish-software varnish Cache Varnish Cache Project varnish Cache Varnish Cache Project |
17 Mar 2022, 16:23
Type | Values Removed | Values Added |
---|---|---|
References | (MLIST) https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html - Mailing List, Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2022/dsa-5088 - Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/ - Mailing List, Third Party Advisory | |
First Time |
Debian
Debian debian Linux Fedoraproject fedora Fedoraproject |
|
CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
04 Mar 2022, 13:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
16 Feb 2022, 04:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
14 Feb 2022, 12:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
07 Feb 2022, 18:16
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:varnish-software:varnich_cache:*:*:*:*:lts:*:*:* cpe:2.3:a:varnish-software:varnich_cache:*:*:*:*:-:*:*:* cpe:2.3:a:varnish-software:varnich_cache:*:*:*:*:plus:*:*:* cpe:2.3:a:varnish-software:varnich_cache:4.1:*:*:*:lts:*:*:* |
|
First Time |
Varnish-software varnich Cache
Varnish-software |
|
CWE | CWE-444 | |
References | (MISC) https://varnish-cache.org/security/VSV00008.html - Mitigation, Vendor Advisory | |
References | (MISC) https://docs.varnish-software.com/security/VSV00008/ - Mitigation, Vendor Advisory | |
CVSS |
v2 : v3 : |
v2 : 6.4
v3 : 9.1 |
26 Jan 2022, 01:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-01-26 01:15
Updated : 2023-12-10 14:09
NVD link : CVE-2022-23959
Mitre link : CVE-2022-23959
CVE.ORG link : CVE-2022-23959
JSON object : View
Products Affected
varnish-software
- varnish_cache
- varnish_cache_plus
- varnich_cache
varnish_cache_project
- varnish_cache
debian
- debian_linux
fedoraproject
- fedora
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')