PT-2021-21330 · Varnish+5 · Varnish Enterprise+6

Martin Blix Grydeland · Published 2021-07-14 · Updated 2024-03-06 · CVE-2021-36740

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Varnish Enterprise versions 6.0.x through 6.0.8r2 Varnish Cache versions 5.x through 6.5.1 Varnish Cache versions 6.6.x through 6.6.0 Varnish Cache 6.0 LTS versions prior to 6.0.8

Description The issue allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request when HTTP/2 is enabled.

Recommendations For Varnish Enterprise versions 6.0.x through 6.0.8r2, update to version 6.0.8r3 or later. For Varnish Cache versions 5.x through 6.5.1, update to version 6.5.2 or later. For Varnish Cache versions 6.6.x through 6.6.0, update to version 6.6.1 or later. For Varnish Cache 6.0 LTS versions prior to 6.0.8, update to version 6.0.8 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BIT-VARNISH-2021-36740

CESA-2021_2988

CVE-2021-36740

DSA-5088-1

MGASA-2021-0387

OESA-2021-1374

OPENSUSE-SU-2022:0148-1

RHSA-2021:2988

RHSA-2021:2993

RHSA-2021_2988

RLSA-2021:2988

USN-5474-1

Affected Products

Centos

Linuxmint

Red Hat

Rocky Linux

Ubuntu

Varnish Cache

Varnish Enterprise

References · 45

• https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf · Patch
• https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be · Patch
• https://advisories.mageia.org/MGASA-2021-0387.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36740 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1374 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-36740 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHBNLDEOTGYRIEQZBWV7F6VPYS4O2AAK · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36740 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:2988 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20637 · Vendor Advisory
• https://varnish-cache.org/security/VSV00007.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11653 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5474-1 · Vendor Advisory