CVE:CVE-2022-45060
CNNVD:CNNVD-202211-2422
Varnish Cache是一套反向网站缓存服务器。
Varnish Cache 5.x版本、6.x版本至6.0.11之前版本、7.x版本至7.1.2之前版本、7.2.x版本至7.2.1之前版本存在安全漏洞。攻击者利用该漏洞通过HTTP/2 pseudo-headers引入在HTTP/1请求中无效的字符，导致Varnish服务器向后端产生无效的HTTP/1请求。
solution:Upgrade varnish-software varnish_cache to a higher version than 6.0.11,and avoid the version [6.0.0,6.0.11); Upgrade varnish-software varnish_cache_plus to a higher version than 6.0.0,6.0.0:r0,6.0.0:r1,6.0.0:r2,6.0.1:r1,6.0.1:r2,6.0.1:r3,6.0.1:r4,6.0.1:r5,6.0.2:r1,6.0.3:r1,6.0.3:r2,6.0.3:r3,6.0.3:r4,6.0.3:r5,6.0.3:r6,6.0.3:r7,6.0.3:r8,6.0.3:r9,6.0.4:r1,6.0.4:r2,6.0.4:r3,6.0.5:r1,6.0.5:r2,6.0.5:r3,6.0.6:r1,6.0.6:r10,6.0.6:r2,6.0.6:r3,6.0.6:r4,6.0.6:r5,6.0.6:r6,6.0.6:r7,6.0.6:r8,6.0.6:r9,6.0.7:r1,6.0.7:r2,6.0.7:r3,6.0.8:r1,6.0.8:r2,6.0.8:r3,6.0.8:r4,6.0.8:r5,6.0.8:r6,6.0.8:r7,6.0.9:r1,6.0.9:r2,6.0.9:r3,6.0.9:r4,6.0.9:r5,6.0.9:r6,6.0.9:r7,6.0.10:r1,6.0.10:r2,and avoid the version 6.0.0,6.0.0:r0,6.0.0:r1,6.0.0:r2,6.0.1:r1,6.0.1:r2,6.0.1:r3,6.0.1:r4,6.0.1:r5,6.0.2:r1,6.0.3:r1,6.0.3:r2,6.0.3:r3,6.0.3:r4,6.0.3:r5,6.0.3:r6,6.0.3:r7,6.0.3:r8,6.0.3:r9,6.0.4:r1,6.0.4:r2,6.0.4:r3,6.0.5:r1,6.0.5:r2,6.0.5:r3,6.0.6:r1,6.0.6:r10,6.0.6:r2,6.0.6:r3,6.0.6:r4,6.0.6:r5,6.0.6:r6,6.0.6:r7,6.0.6:r8,6.0.6:r9,6.0.7:r1,6.0.7:r2,6.0.7:r3,6.0.8:r1,6.0.8:r2,6.0.8:r3,6.0.8:r4,6.0.8:r5,6.0.8:r6,6.0.8:r7,6.0.9:r1,6.0.9:r2,6.0.9:r3,6.0.9:r4,6.0.9:r5,6.0.9:r6,6.0.9:r7,6.0.10:r1,6.0.10:r2; Upgrade varnish_cache_project varnish_cache to a higher version than 6.0.11,7.1.2,7.2.0,and avoid the version [5.0.0,6.0.11),[7.0.0,7.1.2),7.2.0; Upgrade fedoraproject fedora to a higher version than 35,36,37,and avoid the version 35,36,37; Upgrade debian debian_linux to a higher version than 10.0,11.0,and avoid the version 10.0,11.0