CVE-2022-38150
Last modified
CVE-2022-38150 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. EPSS estimates a 1.14% chance of exploitation in the next 30 days.
Description
In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Varnish Cache Project | Varnish Cache | 7.0.0 |
| Varnish Cache Project | Varnish Cache | 7.0.1 |
| Varnish Cache Project | Varnish Cache | 7.0.2 |
| Varnish Cache Project | Varnish Cache | 7.1.0 |
| Fedoraproject | Fedora | 35 |
| Fedoraproject | Fedora | 36 |
References
- https://varnish-cache.org/security/VSV00009.htmlMitigation, Vendor Advisory
- https://varnish-cache.org/security/VSV00009.htmlMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-38150?
How severe is CVE-2022-38150?
How do I fix CVE-2022-38150?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-38145Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
- CVE-2022-38146Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
- CVE-2022-38147Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
- CVE-2022-38148Silverstripe silverstripe/framework through 4.11 allows SQL …8.8
- CVE-2022-38149HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 m…7.5
- CVE-2022-3815A vulnerability, which was classified as problematic, has be…6.5
- CVE-2022-38152An issue was discovered in wolfSSL before 5.5.0. When a TLS …7.5
- CVE-2022-38153An issue was discovered in wolfSSL before 5.5.0 (when --enab…5.9
- CVE-2022-38155TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted …7.5
- CVE-2022-38156A remote command injection issues exists in the web server o…7.2
- CVE-2022-3816A vulnerability, which was classified as problematic, was fo…6.5
- CVE-2022-38161The Gumstix Overo SBC on the VSKS board through 2022-08-09, …7.5
Are you affected by CVE-2022-38150?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST