Описание
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
A flaw was found in Varnish. The Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. As a result, this flaw allows the information on the Varnish cache to be poisoned. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Меры по смягчению последствий
This issue can be mitigated by:
- Disabling HTTP/2 request support by executing:
- Disabling backend connection reuse on varnish side, the following rule can be inserted into Varnish configuration:
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 9 | varnish | Not affected | ||
| Red Hat Enterprise Linux 8 | varnish | Fixed | RHSA-2021:2988 | 02.08.2021 |
| Red Hat Enterprise Linux 8.1 Extended Update Support | varnish | Fixed | RHSA-2021:2988 | 02.08.2021 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | varnish | Fixed | RHSA-2021:2988 | 02.08.2021 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-varnish6-varnish | Fixed | RHSA-2021:2993 | 03.08.2021 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-varnish6-varnish-modules | Fixed | RHSA-2021:2993 | 03.08.2021 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-varnish6-varnish | Fixed | RHSA-2021:2993 | 03.08.2021 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-varnish6-varnish-modules | Fixed | RHSA-2021:2993 | 03.08.2021 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL a ...
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
EPSS
8.1 High
CVSS3