832207 – (CVE-2022-23959) <www-servers/varnish-7.1.0: HTTP/1 request smuggling

Bug 832207 (CVE-2022-23959) - <www-servers/varnish-7.1.0: HTTP/1 request smuggling

Summary: <www-servers/varnish-7.1.0: HTTP/1 request smuggling

Status:	RESOLVED FIXED

Alias:	CVE-2022-23959

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://varnish-cache.org/security/VS...
Whiteboard:	B4 [noglsa]
Keywords:

Depends on:	860990
Blocks:
	Show dependency tree

Reported:	2022-01-28 13:53 UTC by John Helmert III
Modified:	2022-07-26 21:20 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-01-28 13:53:16 UTC

CVE-2022-23959:

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.


Please bump to 6.6.2 and 7.0.2.

Comment 1 Anthony Basile gentoo-dev

2022-07-22 15:46:25 UTC

We're going to bump to 7.1.0 which is not vulnerable to this and is currently the supported version.  I'm getting everything ready for a stablereq.

Comment 2 John Helmert III archtester

2022-07-23 17:28:25 UTC

Thanks! Please stable when ready

Comment 3 Anthony Basile gentoo-dev

2022-07-25 14:40:06 UTC

(In reply to John Helmert III from comment #2)
> Thanks! Please stable when ready

Its ready, I'm opening the stabelreq now

Comment 4 Anthony Basile gentoo-dev

2022-07-26 13:43:38 UTC

(In reply to Anthony Basile from comment #3)
> (In reply to John Helmert III from comment #2)
> > Thanks! Please stable when ready
> 
> Its ready, I'm opening the stabelreq now

Vulnerable versions are off the tree and 7.1.0 is all stable.

Comment 5 John Helmert III archtester

2022-07-26 21:20:47 UTC

Thanks! Minimal impact so no GLSA, all done!