CVE-2022-23959

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

Link	Resource
https://varnish-cache.org/security/VSV00008.html	Mitigation Vendor Advisory
https://docs.varnish-software.com/security/VSV00008/	Mitigation Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/	Mailing List Third Party Advisory
https://www.debian.org/security/2022/dsa-5088	Third Party Advisory

Configuration 1

cpe:2.3:a:varnish-software:varnich_cache:4.1:*:*:*:lts:*:*:* cpe:2.3:a:varnish-software:varnich_cache:*:*:*:*:plus:*:*:* cpe:2.3:a:varnish-software:varnich_cache:*:*:*:*:-:*:*:* cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:* cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:lts:*:*:* cpe:2.3:a:varnish-software:varnish_cache_plus:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

---

Published : 2022-01-26 01:15

Updated : 2022-08-02 07:35

---

NVD link : CVE-2022-23959

Mitre link : CVE-2022-23959

No products.

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')