Red Hat Security AdvisoryRHSA-2021:2993
rh-varnish6-varnish security update
Released 2021-08-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-varnish6-varnish-6.0.8-2.el7, rh-varnish6-varnish-devel-6.0.8-2.el7, rh-varnish6-varnish-docs-6.0.8-2.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-varnish6-varnish-6.0.8-2.el7, rh-varnish6-varnish-devel-6.0.8-2.el7, rh-varnish6-varnish-docs-6.0.8-2.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-varnish6-varnish-6.0.8-2.el7, rh-varnish6-varnish-devel-6.0.8-2.el7, rh-varnish6-varnish-docs-6.0.8-2.el7 +2
Fixes 1 record
Priority LOW 32
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01599 · Published 2021-07-14 · Fixed CWE-444
