CVE-2022-23959

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23959.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "6.6.2"
                },
                {
                    "introduced": "7.x"
                },
                {
                    "fixed": "7.0.2"
                },
                {
                    "fixed": "6.0.10"
                },
                {
                    "introduced": "4.1.x"
                },
                {
                    "fixed": "4.1.11r6"
                },
                {
                    "introduced": "6.0.x"
                },
                {
                    "fixed": "6.0.9r4"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/varnishcache/varnish-cache

Affected ranges

Type

GIT

Repo

https://github.com/varnishcache/varnish-cache

Events

Introduced

454733b82a3279a1603516b4f0a07f8bad4bcd55

Fixed

9b5f68e19ca0ab60010641e305fd12822f18d42c

Database specific

{
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.2"
        }
    ],
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*"
}

Affected versions

varnish-7.*

varnish-7.0.0

varnish-7.0.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23959.json"