CVE-2022-45060

An HTTP Request Forgery issue was discovered in Varnish Cache. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could be used to exploit vulnerabilities in a server behind the Varnish server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The following mitigation can be applied under the impossibility of update the varnish package:

1. Add the following snippet under vcl_recv VCL function at /etc/varnish/default.vcl

     if (req.url ~ "(^$)|[ \t]+" || req.method ~ "(^$)|[ \t]+") {
              return (synth(400));
      }

2. Restart the varnish service by running the following command as a privileged user:

systemctl restart varnish

The VCL script above will check by any invalid character or pseudo-header values and when found it will return a synthetic HTTP error code 400.