[SECURITY] [DSA 5334-1] varnish security update

2023-01-2921:13:52

lists.debian.org

varnish

http/2

cve-2022-45060

security update

debian

web accelerator

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.5

Confidence

High

EPSS

0.003

Percentile

69.6%

JSON

Debian Security Advisory DSA-5334-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
January 29, 2023 https://www.debian.org/security/faq

Package : varnish
CVE ID : CVE-2022-45060
Debian Bug : 1023751

Martin van Kervel Smedshammer discovered that varnish, a state of the
art, high-performance web accelerator, is prone to a HTTP/2 request
forgery vulnerability.

See https://varnish-cache.org/security/VSV00011.html for details.

For the stable distribution (bullseye), this problem has been fixed in
version 6.5.1-1+deb11u3.

We recommend that you upgrade your varnish packages.

For the detailed security status of varnish please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/varnish

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian11allvarnish-doc< 6.5.1-1+deb11u3varnish-doc_6.5.1-1+deb11u3_all.deb
Debian11armhflibvarnishapi2< 6.5.1-1+deb11u3libvarnishapi2_6.5.1-1+deb11u3_armhf.deb
Debian10armhflibvarnishapi2-dbgsym< 6.1.1-1+deb10u4libvarnishapi2-dbgsym_6.1.1-1+deb10u4_armhf.deb
Debian10amd64libvarnishapi2< 6.1.1-1+deb10u4libvarnishapi2_6.1.1-1+deb10u4_amd64.deb
Debian11s390xvarnish< 6.5.1-1+deb11u3varnish_6.5.1-1+deb11u3_s390x.deb
Debian11i386varnish-dbgsym< 6.5.1-1+deb11u3varnish-dbgsym_6.5.1-1+deb11u3_i386.deb
Debian11ppc64elvarnish< 6.5.1-1+deb11u3varnish_6.5.1-1+deb11u3_ppc64el.deb
Debian11mipsellibvarnishapi2-dbgsym< 6.5.1-1+deb11u3libvarnishapi2-dbgsym_6.5.1-1+deb11u3_mipsel.deb
Debian10i386varnish< 6.1.1-1+deb10u4varnish_6.1.1-1+deb10u4_i386.deb
Debian10i386varnish-dbgsym< 6.1.1-1+deb10u4varnish-dbgsym_6.1.1-1+deb10u4_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	varnish-doc	< 6.5.1-1+deb11u3	varnish-doc_6.5.1-1+deb11u3_all.deb
Debian	11	armhf	libvarnishapi2	< 6.5.1-1+deb11u3	libvarnishapi2_6.5.1-1+deb11u3_armhf.deb
Debian	10	armhf	libvarnishapi2-dbgsym	< 6.1.1-1+deb10u4	libvarnishapi2-dbgsym_6.1.1-1+deb10u4_armhf.deb
Debian	10	amd64	libvarnishapi2	< 6.1.1-1+deb10u4	libvarnishapi2_6.1.1-1+deb10u4_amd64.deb
Debian	11	s390x	varnish	< 6.5.1-1+deb11u3	varnish_6.5.1-1+deb11u3_s390x.deb
Debian	11	i386	varnish-dbgsym	< 6.5.1-1+deb11u3	varnish-dbgsym_6.5.1-1+deb11u3_i386.deb
Debian	11	ppc64el	varnish	< 6.5.1-1+deb11u3	varnish_6.5.1-1+deb11u3_ppc64el.deb
Debian	11	mipsel	libvarnishapi2-dbgsym	< 6.5.1-1+deb11u3	libvarnishapi2-dbgsym_6.5.1-1+deb11u3_mipsel.deb
Debian	10	i386	varnish	< 6.1.1-1+deb10u4	varnish_6.1.1-1+deb10u4_i386.deb
Debian	10	i386	varnish-dbgsym	< 6.1.1-1+deb10u4	varnish-dbgsym_6.1.1-1+deb10u4_i386.deb