Patchwire CVEs, their patch status, and feeds to follow them

CVE-2022-45060

Fixed in a distro release EPSS 1%CVSS 7.5

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

Published 2022-11-09 · CVE record · OSV

Products: varnish-software varnish_cache, varnish-software varnish_cache_plus, varnish_cache_project varnish_cache, fedoraproject fedora, debian_linux

Distro releases

ReleasePackageFixed in
AlmaLinux 8varnish6.0.8-2.module_el8.7.0+3353+b11d8f2f.1
AlmaLinux 8varnish-devel6.0.8-2.module_el8.7.0+3353+b11d8f2f.1
AlmaLinux 8varnish-docs6.0.8-2.module_el8.7.0+3353+b11d8f2f.1
AlmaLinux 8varnish-modules0.15.0-6.module_el8.6.0+3089+dac88e97
AlmaLinux 8varnish-modules0.15.0-6.module_el8.5.0+2620+03a0c2cc
AlmaLinux 8varnish-modules0.15.0-6.module_el8.5.0+76+a10ffa55
AlmaLinux 9varnish6.6.2-2.el9_1.1
AlmaLinux 9varnish-devel6.6.2-2.el9_1.1
AlmaLinux 9varnish-docs6.6.2-2.el9_1.1
Alpine 3.17varnish7.2.1-r0
Alpine 3.18varnish7.2.1-r0
Alpine 3.19varnish7.2.1-r0
Alpine 3.20varnish7.2.1-r0
Alpine 3.21varnish7.2.1-r0
Alpine 3.22varnish7.2.1-r0
Alpine 3.23varnish7.2.1-r0
Alpine 3.24varnish7.2.1-r0
Debian 10varnish6.1.1-1+deb10u4
Debian 11varnish6.5.1-1+deb11u3
Debian 12varnish7.1.1-1.1
Debian 13varnish7.1.1-1.1
Red Hat Enterprise Linux 8varnish0:6.0.8-2.module+el8.7.0+17239+94d153bd.1
Red Hat Enterprise Linux 8varnish-devel0:6.0.8-2.module+el8.7.0+17239+94d153bd.1
Red Hat Enterprise Linux 8varnish-docs0:6.0.8-2.module+el8.7.0+17239+94d153bd.1
Red Hat Enterprise Linux 8varnish-modules0:0.15.0-6.module+el8.5.0+11976+0b4af72d
Red Hat Enterprise Linux 8varnish-modules-debuginfo0:0.15.0-6.module+el8.5.0+11976+0b4af72d
Red Hat Enterprise Linux 8varnish-modules-debugsource0:0.15.0-6.module+el8.5.0+11976+0b4af72d
Red Hat Enterprise Linux 9varnish0:6.6.2-2.el9_1.1
Red Hat Enterprise Linux 9varnish-devel0:6.6.2-2.el9_1.1
Red Hat Enterprise Linux 9varnish-docs0:6.6.2-2.el9_1.1
Red Hat rhel aus 8.2varnish0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel aus 8.2varnish-devel0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel aus 8.2varnish-docs0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel aus 8.2varnish-modules0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel aus 8.2varnish-modules-debuginfo0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel aus 8.2varnish-modules-debugsource0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel e4s 8.1varnish0:6.0.2-2.module+el8.1.0+17243+35307414.2
Red Hat rhel e4s 8.1varnish-devel0:6.0.2-2.module+el8.1.0+17243+35307414.2
Red Hat rhel e4s 8.1varnish-docs0:6.0.2-2.module+el8.1.0+17243+35307414.2
Red Hat rhel e4s 8.1varnish-modules0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel e4s 8.1varnish-modules-debuginfo0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel e4s 8.1varnish-modules-debugsource0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel e4s 8.2varnish0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel e4s 8.2varnish-devel0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel e4s 8.2varnish-docs0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel e4s 8.2varnish-modules0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel e4s 8.2varnish-modules-debuginfo0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel e4s 8.2varnish-modules-debugsource0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel eus 8.4varnish0:6.0.6-2.module+el8.4.0+17241+96fc0d9c.3
Red Hat rhel eus 8.4varnish-devel0:6.0.6-2.module+el8.4.0+17241+96fc0d9c.3
Red Hat rhel eus 8.4varnish-docs0:6.0.6-2.module+el8.4.0+17241+96fc0d9c.3
Red Hat rhel eus 8.4varnish-modules0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
Red Hat rhel eus 8.4varnish-modules-debuginfo0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
Red Hat rhel eus 8.4varnish-modules-debugsource0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
Red Hat rhel eus 8.6varnish0:6.0.8-2.module+el8.6.0+17240+b7b5e45c.1
Red Hat rhel eus 8.6varnish-devel0:6.0.8-2.module+el8.6.0+17240+b7b5e45c.1
Red Hat rhel eus 8.6varnish-docs0:6.0.8-2.module+el8.6.0+17240+b7b5e45c.1
Red Hat rhel eus 8.6varnish-modules0:0.15.0-6.module+el8.5.0+11976+0b4af72d
Red Hat rhel eus 8.6varnish-modules-debuginfo0:0.15.0-6.module+el8.5.0+11976+0b4af72d
Red Hat rhel eus 8.6varnish-modules-debugsource0:0.15.0-6.module+el8.5.0+11976+0b4af72d
Red Hat rhel eus 9.0varnish0:6.6.2-2.el9_0.1
Red Hat rhel eus 9.0varnish-devel0:6.6.2-2.el9_0.1
Red Hat rhel eus 9.0varnish-docs0:6.6.2-2.el9_0.1
Red Hat rhel software collections 3rh-varnish6-varnish0:6.0.8-2.el7.2
Red Hat rhel software collections 3rh-varnish6-varnish-devel0:6.0.8-2.el7.2
Red Hat rhel software collections 3rh-varnish6-varnish-docs0:6.0.8-2.el7.2
Red Hat rhel software collections 3rh-varnish6-varnish-libs0:6.0.8-2.el7.2
Red Hat rhel tus 8.2varnish0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel tus 8.2varnish-devel0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel tus 8.2varnish-docs0:6.0.2-2.module+el8.2.0+17242+97092129.2
Red Hat rhel tus 8.2varnish-modules0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel tus 8.2varnish-modules-debuginfo0:0.15.0-4.module+el8+2481+4078e9d2
Red Hat rhel tus 8.2varnish-modules-debugsource0:0.15.0-4.module+el8+2481+4078e9d2
Rocky Linux 8varnish0:6.0.8-2.module+el8.7.0+1094+66cdd070.1
Rocky Linux 8varnish-modules0:0.15.0-6.module+el8.5.0+677+2a78a869
Rocky Linux 9varnish0:6.6.2-2.el9_1.1
SUSE Package Hub 15 SP4varnish7.2.1-bp154.2.9.1
Ubuntu Pro 18.04 LTSvarnish5.2.1-1ubuntu0.1+esm1
Ubuntu Pro 20.04 LTSvarnish6.2.1-2ubuntu0.2+esm1
Ubuntu Pro 22.04 LTSvarnish6.6.1-1ubuntu0.2+esm1
openSUSE Leap 15.4varnish7.2.1-bp154.2.9.1
openSUSE Tumbleweedvarnish7.2.1-1.1
openSUSE Tumbleweedvinyl-cache9.0.0-1.1