CVE-2022-45060 Other in n/a
Attackers can inject invalid characters via HTTP/2 pseudo-headers, causing Varnish to send malformed requests to backends, potentially exploiting downstream vulnerabilities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-45060?
CVE-2022-45060 is a high-severity vulnerability in Debian Debian Linux, published on 9 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
Weakness: CWE-20
Which versions are affected by CVE-2022-45060?
1 open source package ship an affected version, including varnish. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
varnish Bitnami | From 5.0.0 | 6.0.11, 7.1.2, 7.2.1 |
Linux distribution packages (39)
varnish AlmaLinux:8 | All versions | 6.0.8-2.module_el8.7.0+3353+b11d8f2f.1 |
varnish-devel AlmaLinux:8 | All versions | 6.0.8-2.module_el8.7.0+3353+b11d8f2f.1 |
varnish-docs AlmaLinux:8 | All versions | 6.0.8-2.module_el8.7.0+3353+b11d8f2f.1 |
varnish-modules AlmaLinux:8 | All versions | 0.15.0-6.module_el8.5.0+2620+03a0c2cc |
varnish-modules AlmaLinux:8 | All versions | 0.15.0-6.module_el8.5.0+76+a10ffa55 |
varnish-modules AlmaLinux:8 | All versions | 0.15.0-6.module_el8.6.0+3089+dac88e97 |
varnish AlmaLinux:9 | All versions | 6.6.2-2.el9_1.1 |
varnish-devel AlmaLinux:9 | All versions | 6.6.2-2.el9_1.1 |
varnish-docs AlmaLinux:9 | All versions | 6.6.2-2.el9_1.1 |
varnish Red Hat:enterprise_linux:8::appstream | All versions | 0:6.0.8-2.module+el8.7.0+17239+94d153bd.1 |
varnish-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:6.0.8-2.module+el8.7.0+17239+94d153bd.1 |
varnish-docs Red Hat:enterprise_linux:8::appstream | All versions | 0:6.0.8-2.module+el8.7.0+17239+94d153bd.1 |
varnish-modules Red Hat:enterprise_linux:8::appstream | All versions | 0:0.15.0-6.module+el8.5.0+11976+0b4af72d |
varnish-modules-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.15.0-6.module+el8.5.0+11976+0b4af72d |
varnish-modules-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:0.15.0-6.module+el8.5.0+11976+0b4af72d |
varnish Red Hat:enterprise_linux:9::appstream | All versions | 0:6.6.2-2.el9_1.1 |
varnish-docs Red Hat:enterprise_linux:9::appstream | All versions | 0:6.6.2-2.el9_1.1 |
varnish-devel Red Hat:enterprise_linux:9::crb | All versions | 0:6.6.2-2.el9_1.1 |
varnish Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.0.2-2.module+el8.2.0+17242+97092129.2 |
varnish-devel Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.0.2-2.module+el8.2.0+17242+97092129.2 |
varnish-docs Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.0.2-2.module+el8.2.0+17242+97092129.2 |
varnish-modules Red Hat:rhel_aus:8.2::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish-modules-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish-modules-debugsource Red Hat:rhel_aus:8.2::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish Red Hat:rhel_e4s:8.1::appstream | All versions | 0:6.0.2-2.module+el8.1.0+17243+35307414.2 |
varnish-devel Red Hat:rhel_e4s:8.1::appstream | All versions | 0:6.0.2-2.module+el8.1.0+17243+35307414.2 |
varnish-docs Red Hat:rhel_e4s:8.1::appstream | All versions | 0:6.0.2-2.module+el8.1.0+17243+35307414.2 |
varnish-modules Red Hat:rhel_e4s:8.1::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish-modules-debuginfo Red Hat:rhel_e4s:8.1::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish-modules-debugsource Red Hat:rhel_e4s:8.1::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish Red Hat:rhel_e4s:8.2::appstream | All versions | 0:6.0.2-2.module+el8.2.0+17242+97092129.2 |
varnish-devel Red Hat:rhel_e4s:8.2::appstream | All versions | 0:6.0.2-2.module+el8.2.0+17242+97092129.2 |
varnish-docs Red Hat:rhel_e4s:8.2::appstream | All versions | 0:6.0.2-2.module+el8.2.0+17242+97092129.2 |
varnish-modules Red Hat:rhel_e4s:8.2::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish-modules-debuginfo Red Hat:rhel_e4s:8.2::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish-modules-debugsource Red Hat:rhel_e4s:8.2::appstream | All versions | 0:0.15.0-4.module+el8+2481+4078e9d2 |
varnish Red Hat:rhel_eus:8.4::appstream | All versions | 0:6.0.6-2.module+el8.4.0+17241+96fc0d9c.3 |
varnish-devel Red Hat:rhel_eus:8.4::appstream | All versions | 0:6.0.6-2.module+el8.4.0+17241+96fc0d9c.3 |
varnish-docs Red Hat:rhel_eus:8.4::appstream | All versions | 0:6.0.6-2.module+el8.4.0+17241+96fc0d9c.3 |
Products include Debian Debian Linux, Fedoraproject Fedora, Varnish-Software Varnish Cache, Varnish-Software Varnish Cache Plus, Varnish Cache Project Varnish Cache.
How do I fix CVE-2022-45060?
Upgrade varnish to a fixed version for your release line: 6.0.11, 7.1.2 or 7.2.1.
Is CVE-2022-45060 being exploited?
There is no known exploitation of CVE-2022-45060 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-45060, ALSA-2022:8643, ALSA-2022:8649, BIT-varnish-2022-45060, DEBIAN-CVE-2022-45060, DSA-5334-1 and 15 more.