An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-0d5dcc031e advisory.

    New upstream release: A security release. This release includes fix for CVE-2022-45059 (VSV00011)  and     CVE-2022-45060 (VSV00010). From the upstream release notes:

    VSV00010 Varnish Request Smuggling Vulnerability

    Date: 2022-11-08

    A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers     are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
    Among the headers that can be filtered this way are both Content-Length and Host, making it possible for     an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL.

    VSV00011 Varnish HTTP/2 Request Forgery Vulnerability

    Date: 2022-11-08

    A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned     on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context     of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend.
    This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the varnish-6.6.2-3.el9 build changelog.

  - Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8643 advisory.

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0673 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: Request Forgery Vulnerability (CVE-2022-45060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5334 advisory.

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-99c5ddb2ae advisory.

    This is a security update adding fixes for the following issues

    * VSV00009 aka CVE-2022-38150: Denial of service
    * VSV00010 aka CVE-2022-45059: Request smuggling
    * VSV00011 aka CVE-2022-45060: Request forgery

    For details, see https://varnish-cache.org/security

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-babfbc2622 advisory.

    This release includes fix for CVE-2022-45059 (VSV00010) and CVE-2022-45060 (VSV00011). From the upstream     release notes:

    VSV00010 Varnish Request Smuggling Vulnerability

    Date: 2022-11-08

    A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers     are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
    Among the headers that can be filtered this way are both Content-Length and Host, making it possible for     an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL.

    VSV00011 Varnish HTTP/2 Request Forgery Vulnerability

    Date: 2022-11-08

    A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned     on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context     of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend.
    This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8649 advisory.

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8649 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: Request Forgery Vulnerability (CVE-2022-45060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8643 advisory.

    [6.6.2-2.1]
    - Resolves: #2142095 - CVE-2022-45060 varnish: Request Forgery Vulnerability

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8649 advisory.

    - Resolves: #2142092 - CVE-2022-45060 varnish:6/varnish: Request Forgery       Vulnerability
    - Resolves: #2047650 - CVE-2022-23959 varnish:6/varnish: Varnish HTTP/1 Request       Smuggling Vulnerability

    varnish-modules

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8650 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: Request Forgery Vulnerability (CVE-2022-45060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8643 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: Request Forgery Vulnerability (CVE-2022-45060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8647 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: Request Forgery Vulnerability (CVE-2022-45060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:8649 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8644 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: Request Forgery Vulnerability (CVE-2022-45060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8645 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: Request Forgery Vulnerability (CVE-2022-45060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8646 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: Request Forgery Vulnerability (CVE-2022-45060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3208 advisory.

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10198-1 advisory.

  - An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling     attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop,     preventing the Varnish Cache servers from forwarding critical headers to the backend. (CVE-2022-45059)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211051	Fedora 37 : varnish / varnish-modules (2022-0d5dcc031e)	Nessus	Fedora Local Security Checks	high
191204	CentOS 9 : varnish-6.6.2-3.el9	Nessus	CentOS Local Security Checks	high
184827	Rocky Linux 9 : varnish (RLSA-2022:8643)	Nessus	Rocky Linux Local Security Checks	high
171223	RHEL 7 : rh-varnish6-varnish (RHSA-2023:0673)	Nessus	Red Hat Local Security Checks	high
170771	Debian DSA-5334-1 : varnish - security update	Nessus	Debian Local Security Checks	high
169058	Fedora 35 : varnish (2022-99c5ddb2ae)	Nessus	Fedora Local Security Checks	high
169045	Fedora 36 : varnish (2022-babfbc2622)	Nessus	Fedora Local Security Checks	high
168482	Rocky Linux 8 : varnish:6 (RLSA-2022:8649)	Nessus	Rocky Linux Local Security Checks	high
168323	RHEL 8 : varnish:6 (RHSA-2022:8649)	Nessus	Red Hat Local Security Checks	high
168257	Oracle Linux 9 : varnish (ELSA-2022-8643)	Nessus	Oracle Linux Local Security Checks	high
168226	Oracle Linux 8 : varnish:6 (ELSA-2022-8649)	Nessus	Oracle Linux Local Security Checks	high
168220	RHEL 8 : varnish:6 (RHSA-2022:8650)	Nessus	Red Hat Local Security Checks	high
168219	RHEL 9 : varnish (RHSA-2022:8643)	Nessus	Red Hat Local Security Checks	high
168217	RHEL 8 : varnish:6 (RHSA-2022:8647)	Nessus	Red Hat Local Security Checks	high
168216	CentOS 8 : varnish:6 (CESA-2022:8649)	Nessus	CentOS Local Security Checks	high
168213	RHEL 9 : varnish (RHSA-2022:8644)	Nessus	Red Hat Local Security Checks	high
168210	RHEL 8 : varnish:6 (RHSA-2022:8645)	Nessus	Red Hat Local Security Checks	high
168209	RHEL 8 : varnish:6 (RHSA-2022:8646)	Nessus	Red Hat Local Security Checks	high
168207	Debian DLA-3208-1 : varnish - LTS security update	Nessus	Debian Local Security Checks	high
167344	openSUSE 15 Security Update : varnish (openSUSE-SU-2022:10198-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-45060

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high