ELSA-2021-2988 — Important: varnish:6 security update (Oracle Linux 8)

Summary

varnish
[6.0.6-2.1]
- Resolves: #1982861 - CVE-2021-36740 varnish:6/varnish: HTTP/2 request
smuggling attack via a large Content-Length header for a POST request

varnish-modules
[0.15.0-5]
- Related: #1795673 - RFE: rebase varnish:6 to latest 6.0.x LTS

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 8	varnish	0:6.0.6-2.module+el8.4.0+20258+f99218b2.1
Oracle Linux · 8	varnish-devel	0:6.0.6-2.module+el8.4.0+20258+f99218b2.1
Oracle Linux · 8	varnish-docs	0:6.0.6-2.module+el8.4.0+20258+f99218b2.1
Oracle Linux · 8	varnish-modules	0:0.15.0-5.module+el8.3.0+7653+45014445

Vulnerabilities 1

Unscored —

CVE-2021-36740

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length he…

varnish varnish varnish Debian Ubuntu Alpine

Jul 14, 2021

Important: varnish:6 security update (Oracle Linux 8)

Summary

Fixed packages 4

Vulnerabilities 1

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length he…