Bug 832207 (CVE-2022-23959)

Summary:	<www-servers/varnish-7.1.0: HTTP/1 request smuggling
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	blueness
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://varnish-cache.org/security/VSV00008.html
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---
Bug Depends on:	860990
Bug Blocks:

Description John Helmert III archtester

2022-01-28 13:53:16 UTC

CVE-2022-23959:

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.


Please bump to 6.6.2 and 7.0.2.

Comment 1 Anthony Basile gentoo-dev

2022-07-22 15:46:25 UTC

We're going to bump to 7.1.0 which is not vulnerable to this and is currently the supported version.  I'm getting everything ready for a stablereq.

Comment 2 John Helmert III archtester

2022-07-23 17:28:25 UTC

Thanks! Please stable when ready

Comment 3 Anthony Basile gentoo-dev

2022-07-25 14:40:06 UTC

(In reply to John Helmert III from comment #2)
> Thanks! Please stable when ready

Its ready, I'm opening the stabelreq now

Comment 4 Anthony Basile gentoo-dev

2022-07-26 13:43:38 UTC

(In reply to Anthony Basile from comment #3)
> (In reply to John Helmert III from comment #2)
> > Thanks! Please stable when ready
> 
> Its ready, I'm opening the stabelreq now

Vulnerable versions are off the tree and 7.1.0 is all stable.

Comment 5 John Helmert III archtester

2022-07-26 21:20:47 UTC

Thanks! Minimal impact so no GLSA, all done!