CVE-2022-38150

In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38150.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/varnishcache/varnish-cache

Affected ranges

Type

GIT

Repo

https://github.com/varnishcache/varnish-cache

Events

Introduced

454733b82a3279a1603516b4f0a07f8bad4bcd55

Last affected

c2c07517ddddbc187604b800eff733296e93aaad

Database specific

{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:varnish_cache_project:varnish_cache:7.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:varnish_cache_project:varnish_cache:7.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:varnish_cache_project:varnish_cache:7.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:varnish_cache_project:varnish_cache:7.1.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.0"
        },
        {
            "introduced": "7.0.1"
        },
        {
            "last_affected": "7.0.1"
        },
        {
            "introduced": "7.0.2"
        },
        {
            "last_affected": "7.0.2"
        },
        {
            "introduced": "7.1.0"
        },
        {
            "last_affected": "7.1.0"
        }
    ]
}

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38150.json"