Headline
Debian Security Advisory 5334-1
Debian Linux Security Advisory 5334-1 - Martin van Kervel Smedshammer discovered that varnish, a state of the art, high-performance web accelerator, is prone to a HTTP/2 request forgery vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5334-1 [email protected]://www.debian.org/security/ Salvatore BonaccorsoJanuary 29, 2023 https://www.debian.org/security/faq- -------------------------------------------------------------------------Package : varnishCVE ID : CVE-2022-45060Debian Bug : 1023751Martin van Kervel Smedshammer discovered that varnish, a state of theart, high-performance web accelerator, is prone to a HTTP/2 requestforgery vulnerability.See https://varnish-cache.org/security/VSV00011.html for details.For the stable distribution (bullseye), this problem has been fixed inversion 6.5.1-1+deb11u3.We recommend that you upgrade your varnish packages.For the detailed security status of varnish please refer to its securitytracker page at:https://security-tracker.debian.org/tracker/varnishFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: [email protected] PGP SIGNATURE-----iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmPW4PxfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xNDz0R2Xw//ezfXNoVdUw/N3ym0RS/2RBEjxmyC4tSBihh9xNV/rMr4ez/CqNC5iH2mRYBjcEopyKZpuPiakY3eQC8Erk5TPo4Ky4zv9WPCyzV7a/nBe+bTdkL5VKciouS/tG2B4tHaCTy3oGf6gUV3hJOruNDtJCFxpl3hfADT95wIZ9rKZpP4eSJ7YvU1Sml4ZUenM73WbNP6UUzXXEcpfZbvraBs4l+SDxHrUR4t3MRAX0KXgXPVGD7dhb14A8XKfLX+I7TS6tOgVApagnaH8xCY6+gk3UCyzgWmCkITCvYZOyYNHBoB1hHbIxvJ9PhhKimdMpEwKjGNM+g974j4uOlLQlHDYo0dZIIncBICjbvB/7BgiictilcgcwcnlCofXqroJwzQS/B1K0Pk8tc6Ok/xt9k2QqRru8vYI8CcgxcdpfkVodgnPU/bSbq6a8gFNY4ZJQzVPbcg0Yjw7T0pzZjTnGpBchywzCf2ZOxVyeTNhSCEryhahYuYAJJR029fhPP4brhV0taAthorwc/AdNSdUHnO+2rrcEgpUuBArBku7n4f4dtSixcnWtr9IFDbxW3wr3LINgdNQAtPxlJuMdaI83eeTFMETztROhBt9SGI88Cn0UUC026hs5Osy+m6aHaRq6wAyqjlcf72NDIlu6UAAtc60yUvTIH9VvNKuPr6fQXbEUw==wFUO-----END PGP SIGNATURE-----Related news
Red Hat Security Advisory 2023-0673-01 - Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.
Red Hat Security Advisory 2022-8649-01 - Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.
Red Hat Security Advisory 2022-8650-01 - Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.
Red Hat Security Advisory 2022-8644-01 - Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.
Red Hat Security Advisory 2022-8647-01 - Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.
Red Hat Security Advisory 2022-8645-01 - Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.
An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-45060: varnish: Request Forgery Vulnerability
An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-45060: varnish: Request Forgery Vulnerability
An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-45060: varnish: Request Forgery Vulnerability
An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-45060: varnish: Request Forgery Vulnerability
An update for varnish is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-45060: varnish: Request Forgery Vulnerability