Improper Input Validation The advisory has been revoked - it doesn't affect any version of package varnish-docs (opens in a new tab)

Threat Intelligence

1.5% (75^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL8-VARNISHDOCS-2980146
published12 Aug 2022
disclosed9 Aug 2022

Report a new vulnerability Found a mistake?

Introduced: 9 Aug 2022

CVE-2022-38150 (opens in a new tab) CWE-20 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream varnish-docs package and not the varnish-docs package as distributed by RHEL.

In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.