Vulnerability Description
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Varnish-Software | Varnish Cache | >= 6.0.0, < 6.0.11 |
| Varnish-Software | Varnish Cache Plus | 6.0.0 |
| Varnish Cache Project | Varnish Cache | >= 5.0.0, < 6.0.11 |
| Fedoraproject | Fedora | 35 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://docs.varnish-software.com/security/VSV00011MitigationVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00036.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://varnish-cache.org/security/VSV00011.htmlMitigationVendor Advisory
- https://www.debian.org/security/2023/dsa-5334Third Party Advisory
- https://docs.varnish-software.com/security/VSV00011MitigationVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00036.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://varnish-cache.org/security/VSV00011.htmlMitigationVendor Advisory
- https://www.debian.org/security/2023/dsa-5334Third Party Advisory
FAQ
What is CVE-2022-45060?
CVE-2022-45060 is a vulnerability with a CVSS score of 7.5 (HIGH). An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers th...
How severe is CVE-2022-45060?
CVE-2022-45060 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-45060?
Check the references section above for vendor advisories and patch information. Affected products include: Varnish-Software Varnish Cache, Varnish-Software Varnish Cache Plus, Varnish Cache Project Varnish Cache, Fedoraproject Fedora, Debian Debian Linux.