PT-2022-7316 · Unknown+7 · Varnish Cache+7
Martin Van Kervel Smedshammer
·
Published
2022-11-08
·
Updated
2026-05-11
·
CVE-2022-45060
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Varnish Cache versions 5.x through 6.0.10
Varnish Cache versions 7.x through 7.1.1
Varnish Cache versions 7.2.x through 7.2.0
Description
An HTTP Request Forgery issue was discovered in Varnish Cache, where an attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could be used to exploit vulnerabilities in a server behind the Varnish server.
Recommendations
For Varnish Cache versions 5.x through 6.0.10, update to version 6.0.11 or later.
For Varnish Cache versions 7.x through 7.1.1, update to version 7.1.2 or later.
For Varnish Cache versions 7.2.x through 7.2.0, update to version 7.2.1 or later.
As a temporary workaround, consider restricting access to the Varnish server to minimize the risk of exploitation.
Fix
RCE
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Ubuntu
Varnish Cache