Summary
Martin van Kervel Smedshammer discovered that Varnish did not properly
sanitize certain HTTP headers. A remote attacker could possibly use this
issue to perform a cross-site request forgery (CSRF) attack.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | varnish | 5.2.1-1ubuntu0.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | varnish | 6.2.1-2ubuntu0.2+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | varnish | 6.6.1-1ubuntu0.2+esm1 |
Vulnerabilities 1
-
High 7.5
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x be…
References
-
report
https://ubuntu.com/security/CVE-2022-45060