crítica
CVE-2022-23959
varnish: HTTP/1 request smuggling vulnerability
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | varnish | 7.0.2 |
| alma 8 | varnish:6::varnish, varnish:6::varnish-devel, varnish:6::varnish-docs y 1 más | 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 y 1 más |
| alpine 3.12 | varnish | 6.5.2-r1 |
| alpine 3.13 | varnish | 6.5.2-r1 |
| alpine 3.14 | varnish | 6.6.2-r0 |
| alpine 3.15 | varnish | 7.0.2-r0 |
| alpine 3.16 | varnish | 7.0.2-r0 |
| alpine 3.17 | varnish | 7.0.2-r0 |
| alpine 3.18 | varnish | 7.0.2-r0 |
| alpine 3.19 | varnish | 7.0.2-r0 |
| alpine 3.20 | varnish | 7.0.2-r0 |
| alpine 3.21 | varnish | 7.0.2-r0 |
Mostrar las 49 entradas de 36 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | varnish | 7.0.2 |
| alma 8 | varnish:6::varnish | 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 |
| alma 8 | varnish:6::varnish-devel | 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 |
| alma 8 | varnish:6::varnish-docs | 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 |
| alma 8 | varnish:6::varnish-modules | 0.15.0-6.module_el8.5.0+2620+03a0c2cc |
| alpine 3.12 | varnish | 6.5.2-r1 |
| alpine 3.13 | varnish | 6.5.2-r1 |
| alpine 3.14 | varnish | 6.6.2-r0 |
| alpine 3.15 | varnish | 7.0.2-r0 |
| alpine 3.16 | varnish | 7.0.2-r0 |
| alpine 3.17 | varnish | 7.0.2-r0 |
| alpine 3.18 | varnish | 7.0.2-r0 |
| alpine 3.19 | varnish | 7.0.2-r0 |
| alpine 3.20 | varnish | 7.0.2-r0 |
| alpine 3.21 | varnish | 7.0.2-r0 |
| alpine 3.22 | varnish | 7.0.2-r0 |
| alpine 3.23 | varnish | 7.0.2-r0 |
| alpine 3.24 | varnish | 7.0.2-r0 |
| alpine edge | varnish | 7.0.2-r0 |
| amazon linux 1 | varnish | 4.0.5-3.23.amzn1 |
| amazon linux 1 | varnish-debuginfo | 4.0.5-3.23.amzn1 |
| amazon linux 1 | varnish-docs | 4.0.5-3.23.amzn1 |
| amazon linux 1 | varnish-libs | 4.0.5-3.23.amzn1 |
| amazon linux 1 | varnish-libs-devel | 4.0.5-3.23.amzn1 |
| debian 10 | varnish | 6.1.1-1+deb10u3 |
| debian 11 | varnish | 6.5.1-1+deb11u2 |
| debian 12 | varnish | 7.1.0-5 |
| debian 13 | varnish | 7.1.0-5 |
| debian 9 | varnish | 5.0.0-7+deb9u3 |
| echo | varnish | 7.1.0-5 |
| Oracle Linux 8 | varnish | 6.0.8-1.module+el8.5.0+20491+1af4e193.1 |
| Oracle Linux 8 | varnish-devel | 6.0.8-1.module+el8.5.0+20491+1af4e193.1 |
| Oracle Linux 8 | varnish-docs | 6.0.8-1.module+el8.5.0+20491+1af4e193.1 |
| Oracle Linux 8 | varnish-modules | 0.15.0-6.module+el8.5.0+20320+0b4af72d |
| rapidfort ubuntu 20.04 | varnish | 0:6.6.1-1ubuntu0.2 |
| rapidfort ubuntu 22.04 | varnish | 0:6.6.1-1ubuntu0.2 |
| rapidfort ubuntu 24.04 | varnish | 0:6.6.1-1ubuntu0.2 |
| rocky 8 | varnish:6::varnish | 6.0.8-1.module+el8.5.0+736+fec10e21.1 |
| rocky 8 | varnish:6::varnish-devel | 6.0.8-1.module+el8.5.0+736+fec10e21.1 |
| rocky 8 | varnish:6::varnish-docs | 6.0.8-1.module+el8.5.0+736+fec10e21.1 |
| rocky 8 | varnish:6::varnish-modules | 0.15.0-6.module+el8.5.0+677+2a78a869 |
| root.io debian 11 | rootio-varnish | 6.5.1-1+deb11u2 |
| root.io debian 12 | rootio-varnish | 7.1.0-5 |
| ubuntu 18.04 | varnish | 5.2.1-1ubuntu0.1 |
| ubuntu 18.04-ESM | varnish | 5.2.1-1ubuntu0.1 |
| ubuntu 20.04 | varnish | 6.2.1-2ubuntu0.1 |
| ubuntu 20.04-ESM | varnish | 6.2.1-2ubuntu0.1 |
| ubuntu 21.10 | varnish | 6.5.2-1ubuntu0.2 |
| ubuntu 22.04 | varnish | 6.6.1-1ubuntu0.2 |
Referencias
- https://access.redhat.com/security/cve/CVE-2022-23959
- https://bugzilla.redhat.com/show_bug.cgi?id=2045031
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23959
- https://docs.varnish-software.com/security/VSV00008/
- https://errata.almalinux.org/8/ALSA-2022-0418.html
- https://errata.rockylinux.org/RLSA-2022:0418
- https://linux.oracle.com/cve/CVE-2022-23959.html
- https://linux.oracle.com/errata/ELSA-2022-0418.html
Las 16 referencias
- https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/
- https://nvd.nist.gov/vuln/detail/CVE-2022-23959
- https://ubuntu.com/security/notices/USN-5474-1
- https://varnish-cache.org/security/VSV00008.html
- https://varnish-cache.org/security/VSV00008.html#vsv00008
- https://www.cve.org/CVERecord?id=CVE-2022-23959
- https://www.debian.org/security/2022/dsa-5088