An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the varnish-6.6.2-3.el9 build changelog.

  - Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8643 advisory.

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0673 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5334 advisory.

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-99c5ddb2ae advisory.

  - In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and     automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of     the backend response status line. This is fixed in 7.0.3 and 7.1.1. (CVE-2022-38150)

  - An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling     attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop,     preventing the Varnish Cache servers from forwarding critical headers to the backend. (CVE-2022-45059)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-babfbc2622 advisory.

  - An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling     attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop,     preventing the Varnish Cache servers from forwarding critical headers to the backend. (CVE-2022-45059)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8649 advisory.

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8649 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8643 advisory.

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8649 advisory.

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8650 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8643 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8647 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:8649 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8644 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8645 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8646 advisory.

  - varnish: Request Forgery Vulnerability (CVE-2022-45060)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3208 advisory.

  - An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before     6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an     assertion failure and daemon restart, which causes a performance loss. (CVE-2020-11653)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10198-1 advisory.

  - An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling     attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop,     preventing the Varnish Cache servers from forwarding critical headers to the backend. (CVE-2022-45059)

  - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2,     and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are     invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1     requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the     Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. (CVE-2022-45060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191204	CentOS 9 : varnish-6.6.2-3.el9	Nessus	CentOS Local Security Checks	high
184827	Rocky Linux 9 : varnish (RLSA-2022:8643)	Nessus	Rocky Linux Local Security Checks	high
171223	RHEL 7 : rh-varnish6-varnish (RHSA-2023:0673)	Nessus	Red Hat Local Security Checks	high
170771	Debian DSA-5334-1 : varnish - security update	Nessus	Debian Local Security Checks	high
169058	Fedora 35 : varnish (2022-99c5ddb2ae)	Nessus	Fedora Local Security Checks	high
169045	Fedora 36 : varnish (2022-babfbc2622)	Nessus	Fedora Local Security Checks	high
168482	Rocky Linux 8 : varnish:6 (RLSA-2022:8649)	Nessus	Rocky Linux Local Security Checks	high
168323	RHEL 8 : varnish:6 (RHSA-2022:8649)	Nessus	Red Hat Local Security Checks	high
168257	Oracle Linux 9 : varnish (ELSA-2022-8643)	Nessus	Oracle Linux Local Security Checks	high
168226	Oracle Linux 8 : varnish:6 (ELSA-2022-8649)	Nessus	Oracle Linux Local Security Checks	high
168220	RHEL 8 : varnish:6 (RHSA-2022:8650)	Nessus	Red Hat Local Security Checks	high
168219	RHEL 9 : varnish (RHSA-2022:8643)	Nessus	Red Hat Local Security Checks	high
168217	RHEL 8 : varnish:6 (RHSA-2022:8647)	Nessus	Red Hat Local Security Checks	high
168216	CentOS 8 : varnish:6 (CESA-2022:8649)	Nessus	CentOS Local Security Checks	high
168213	RHEL 9 : varnish (RHSA-2022:8644)	Nessus	Red Hat Local Security Checks	high
168210	RHEL 8 : varnish:6 (RHSA-2022:8645)	Nessus	Red Hat Local Security Checks	high
168209	RHEL 8 : varnish:6 (RHSA-2022:8646)	Nessus	Red Hat Local Security Checks	high
168207	Debian DLA-3208-1 : varnish - LTS security update	Nessus	Debian Local Security Checks	high
167344	openSUSE 15 Security Update : varnish (openSUSE-SU-2022:10198-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-45060

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high