CVE-2022-45059 — HTTP Request Smuggling in Cache Project Varnish Cache

CWE-444 — HTTP Request Smuggling6 documents6 sources
Severity
7.5HIGHNVD
EPSS
1.5%
top 18.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Varnish-cache VarnishVarnish Cache Project Varnish CacheFedoraproject Fedora
Timeline
PublishedNov 9

Description

An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶Debianvarnish-cache/varnish< 7.1.1-1.1+2

Also affects: Fedora 35, 36, 37

🔴Vulnerability Details

3
OSV
CVE-2022-45059: An issue was discovered in Varnish Cache 7↗2022-11-09
▶
CVEList
CVE-2022-45059: An issue was discovered in Varnish Cache 7↗2022-11-09
▶
GHSA
GHSA-p22x-6r5h-g873: An issue was discovered in Varnish Cache 7↗2022-11-09
▶

📋Vendor Advisories

2
Red Hat
varnish: Request Smuggling Vulnerability↗2022-11-08
▶
Debian
CVE-2022-45059: varnish - An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1...↗2022
▶
CVE-2022-45059 — HTTP Request Smuggling | cvebase