Red Hat Security AdvisoryRHSA-2021:2988
varnish:6 security update
Released 2021-08-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) varnish-6.0.6-2.module+el8.4.0+11921+1a6539fc.1.aarch64::varnish:6, varnish-6.0.6-2.module+el8.4.0+11921+1a6539fc.1.ppc64le::varnish:6, varnish-6.0.6-2.module+el8.4.0+11921+1a6539fc.1.s390x::varnish:6 +15
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) varnish-6.0.2-2.module+el8.1.0+11974+ea5ba4f1.aarch64::varnish:6, varnish-6.0.2-2.module+el8.1.0+11974+ea5ba4f1.ppc64le::varnish:6, varnish-6.0.2-2.module+el8.1.0+11974+ea5ba4f1.s390x::varnish:6 +15
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) varnish-6.0.2-2.module+el8.2.0+11973+a748eca7.aarch64::varnish:6, varnish-6.0.2-2.module+el8.2.0+11973+a748eca7.ppc64le::varnish:6, varnish-6.0.2-2.module+el8.2.0+11973+a748eca7.s390x::varnish:6 +15
Fixes 1 record
Priority LOW 32
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01599 · Published 2021-07-14 · Fixed CWE-444
