7.5
CVE-2022-45060
- EPSS 0.98%
- Veröffentlicht 09.11.2022 06:15:09
- Zuletzt bearbeitet 01.05.2025 15:15:58
- Erkennungen
LoginAn HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Varnish-software ≫ Varnish Cache SwEdition lts Version >= 6.0.0 < 6.0.11
Varnish-software ≫ Varnish Cache Plus Version 6.0.0 Update -
Varnish-software ≫ Varnish Cache Plus Version 6.0.0 Update r0
Varnish-software ≫ Varnish Cache Plus Version 6.0.0 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.0 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.1 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.1 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.1 Update r3
Varnish-software ≫ Varnish Cache Plus Version 6.0.1 Update r4
Varnish-software ≫ Varnish Cache Plus Version 6.0.1 Update r5
Varnish-software ≫ Varnish Cache Plus Version 6.0.2 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r3
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r4
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r5
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r6
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r7
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r8
Varnish-software ≫ Varnish Cache Plus Version 6.0.3 Update r9
Varnish-software ≫ Varnish Cache Plus Version 6.0.4 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.4 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.4 Update r3
Varnish-software ≫ Varnish Cache Plus Version 6.0.5 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.5 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.5 Update r3
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r10
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r3
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r4
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r5
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r6
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r7
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r8
Varnish-software ≫ Varnish Cache Plus Version 6.0.6 Update r9
Varnish-software ≫ Varnish Cache Plus Version 6.0.7 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.7 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.7 Update r3
Varnish-software ≫ Varnish Cache Plus Version 6.0.8 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.8 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.8 Update r3
Varnish-software ≫ Varnish Cache Plus Version 6.0.8 Update r4
Varnish-software ≫ Varnish Cache Plus Version 6.0.8 Update r5
Varnish-software ≫ Varnish Cache Plus Version 6.0.8 Update r6
Varnish-software ≫ Varnish Cache Plus Version 6.0.8 Update r7
Varnish-software ≫ Varnish Cache Plus Version 6.0.9 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.9 Update r2
Varnish-software ≫ Varnish Cache Plus Version 6.0.9 Update r3
Varnish-software ≫ Varnish Cache Plus Version 6.0.9 Update r4
Varnish-software ≫ Varnish Cache Plus Version 6.0.9 Update r5
Varnish-software ≫ Varnish Cache Plus Version 6.0.9 Update r6
Varnish-software ≫ Varnish Cache Plus Version 6.0.9 Update r7
Varnish-software ≫ Varnish Cache Plus Version 6.0.10 Update r1
Varnish-software ≫ Varnish Cache Plus Version 6.0.10 Update r2
Varnish Cache Project ≫ Varnish Cache Version >= 5.0.0 < 6.0.11
Varnish Cache Project ≫ Varnish Cache Version >= 7.0.0 < 7.1.2
Varnish Cache Project ≫ Varnish Cache Version 7.2.0
Fedoraproject ≫ Fedora Version 35
Fedoraproject ≫ Fedora Version 36
Fedoraproject ≫ Fedora Version 37
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.98% | 0.595 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| CISA-ADP | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/
https://docs.varnish-software.com/security/VSV00011
https://varnish-cache.org/security/VSV00011.html
https://www.debian.org/security/2023/dsa-5334