Important: varnish:6 security update
Summary
ALSA-2022:0418: Important: varnish:6 security update. Affects varnish across 2 version ranges.
< 6.0.8-1.module_el8.5.0+76+a10ffa55
< 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1
Fixed in 6.0.8-1.module_el8.5.0+76+a10ffa55 or 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Varnish Cache is a high-performance HTTP accelerator that stores web pages in memory to speed up website performance. It is vulnerable to an HTTP/1 request smuggling vulnerability (CVE-2022-23959).
Vulnerability Detail
The vulnerability in Varnish Cache allows for HTTP/1 request smuggling, which can lead to various security issues. An attacker could exploit this vulnerability to bypass security controls, perform cross-site scripting (XSS) attacks, or gain unauthorized access to sensitive information. The impact of this vulnerability can be severe, depending on the specific use case and configuration of Varnish Cache.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update varnish-
< 6.0.8-1.module_el8.5.0+76+a10ffa556.0.8-1.module_el8.5.0+76+a10ffa55 -
< 6.0.8-1.module_el8.5.0+2620+03a0c2cc.16.0.8-1.module_el8.5.0+2620+03a0c2cc.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to protect your system.
Conclusion
Varnish Cache is vulnerable to an HTTP/1 request smuggling vulnerability. To mitigate this vulnerability, it is recommended to update Varnish Cache to the latest version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for varnish →
FAQ
Varnish Cache is a high-performance HTTP accelerator that stores web pages in memory, improving website speed and reducing server load.
An HTTP/1 request smuggling vulnerability allows an attacker to manipulate the interpretation of HTTP requests, potentially bypassing security controls or performing malicious actions.
The impact of this vulnerability can vary depending on the specific use case and configuration of Varnish Cache. It could potentially lead to security bypass, cross-site scripting (XSS) attacks, or unauthorized access to sensitive information.
To fix this vulnerability, update Varnish Cache to version 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 or later. Refer to the official documentation or consult your distribution's package manager for instructions.
No, there is no known workaround for this vulnerability. It is crucial to apply the security update to protect your system.
References
Related vulnerabilities
Recent vulnerabilities recorded for varnish.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
