by Kastro
Paper/Archive/CVE-2022-23959

CVE-2022-23959

mitre — In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x be…

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 80.9.809 × 2016.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refvarnish-cache.org/security/VSV00008.htmlrefdocs.varnish-software.com/security/VSV00008reflists.debian.org/debian-lts-announce/2022/02/msg00014.htmladvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYTadvisorydebian.org/security/2022/dsa-5088