An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.

The remote host is affected by the vulnerability described in GLSA-202608-26 (Vinyl Cache: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Vinyl Cache. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling
    attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop,
    preventing the Varnish Cache servers from forwarding critical headers to the backend. (CVE-2022-45059)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,
    and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are
    invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1
    requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the
    Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-0d5dcc031e advisory.

    New upstream release: A security release. This release includes fix for CVE-2022-45059 (VSV00011)  and     CVE-2022-45060 (VSV00010). From the upstream release notes:

    VSV00010 Varnish Request Smuggling Vulnerability

    Date: 2022-11-08

    A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers     are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
    Among the headers that can be filtered this way are both Content-Length and Host, making it possible for     an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL.

    VSV00011 Varnish HTTP/2 Request Forgery Vulnerability

    Date: 2022-11-08

    A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned     on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context     of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend.
    This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-99c5ddb2ae advisory.

    This is a security update adding fixes for the following issues

    * VSV00009 aka CVE-2022-38150: Denial of service
    * VSV00010 aka CVE-2022-45059: Request smuggling
    * VSV00011 aka CVE-2022-45060: Request forgery

    For details, see https://varnish-cache.org/security

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-babfbc2622 advisory.

    This release includes fix for CVE-2022-45059 (VSV00010) and CVE-2022-45060 (VSV00011). From the upstream     release notes:

    VSV00010 Varnish Request Smuggling Vulnerability

    Date: 2022-11-08

    A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers     are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
    Among the headers that can be filtered this way are both Content-Length and Host, making it possible for     an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL.

    VSV00011 Varnish HTTP/2 Request Forgery Vulnerability

    Date: 2022-11-08

    A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned     on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context     of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend.
    This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10198-1 advisory.

  - An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling     attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop,     preventing the Varnish Cache servers from forwarding critical headers to the backend. (CVE-2022-45059)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
339932	GLSA-202608-26 : Vinyl Cache: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	low
424645	Alpine: multiple varnish packages: security update to 7.2.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
424645	Alpine: multiple varnish packages: security update to 7.2.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
211051	Fedora 37 : varnish / varnish-modules (2022-0d5dcc031e)	Nessus	Fedora Local Security Checks	Local	high
169058	Fedora 35 : varnish (2022-99c5ddb2ae)	Nessus	Fedora Local Security Checks	Local	high
169045	Fedora 36 : varnish (2022-babfbc2622)	Nessus	Fedora Local Security Checks	Local	high
167344	openSUSE 15 Security Update : varnish (openSUSE-SU-2022:10198-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2022-45059

high

Tenable Plugins

low

high

high

high

high

high

high