{"schemaVersion":3,"id":"OPENSUSE-SU-2022:0148-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for varnish\n\nThis update for varnish fixes the following issues:\n\nvarnish was updated to release 7.1.0 [boo#1195188] [CVE-2022-23959]\n\n* VCL: It is now possible to assign a BLOB value to a BODY\n  variable, in addition to STRING as before.\n* VMOD: New STRING strftime(TIME time, STRING format) function\n  for UTC formatting.\n\nUpdate to release 6.6.1\n\n* CVE-2021-36740: Fix an HTTP/2.0 request smuggling vulnerability. [boo#1188470]\n\nUpdate to release 6.6.0:\n\n* The ban_cutoff parameter now refers to the overall length of\n  the ban list, including completed bans, where before only\n  non-completed (“active”) bans were counted towards ban_cutoff.\n* Body bytes accounting has been fixed to always represent the\n  number of body bytes moved on the wire, exclusive of\n  protocol-specific overhead like HTTP/1 chunked encoding or\n  HTTP/2 framing.\n* The connection close reason has been fixed to properly report\n  SC_RESP_CLOSE where previously only SC_REQ_CLOSE was reported.\n* Unless the new validate_headers feature is disabled, all newly\n  set headers are now validated to contain only characters\n  allowed by RFC7230.\n* The filter_re, keep_re and get_re functions from the bundled\n  cookie vmod have been changed to take the VCL_REGEX type. This\n  implies that their regular expression arguments now need to be\n  literal, not e.g. string.\n* The interface for private pointers in VMODs has been changed,\n  the VRT backend interface has been changed, many filter\n  (VDP/VFP) related signatures have been changed, and the\n  stevedore API has been changed. (Details thereto, see online\n  changelog.)\n\nUpdate to release 6.5.1\n\n* Bump the VRT_MAJOR_VERSION number defined in the vrt.h\n\nUpdate to release 6.5.0\n\n* `PRIV_TOP` is now thread-safe to support parallel ESI\n  implementations.\n* varnishstat's JSON output format (-j option) has been changed.\n* Behavior for 304-type responses was changed not to update the\n  Content-Encoding response header of the stored object.\n\n- Update Git-Web repository link\n\nUpdate to release 6.4.0\n\n* The MAIN.sess_drop counter is gone.\n* backend 'none' was added for 'no backend'.\n* The hash algorithm of the hash director was changed, so\n  backend selection will change once only when upgrading.\n* It is now possible for VMOD authors to customize the\n  connection pooling of a dynamic backend.\n* For more, see changes.rst.\n\nUpdate to release 6.3.2\n\n* Fix a denial of service vulnerability when using the proxy\n  protocol version 2.\n\nUpdate to release 6.3.0\n\n* The Host: header is folded to lower-case in the builtin_vcl.\n* Improved performance of shared memory statistics counters.\n* Synthetic objects created from vcl_backend_error {} now\n  replace existing stale objects as ordinary backend fetches\n  would (for details see changes.rst)","dates":{"published":"2022-05-27T04:23:45.000Z","modified":"2026-02-04T02:24:01.692Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"varnish&distro=openSUSE Leap 15.3","name":"varnish","label":"varnish&distro=openSUSE Leap 15.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/varnish&distro=openSUSE Leap 15.3","purlType":"rpm","versions":[{"text":"< 7.1.0-bp153.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.1.0-bp153.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"varnish&distro=SUSE Package Hub 15 SP3","name":"varnish","label":"varnish&distro=SUSE Package Hub 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/varnish&distro=SUSE Package Hub 15 SP3","purlType":"rpm","versions":[{"text":"< 7.1.0-bp153.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.1.0-bp153.2.3.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KTY3FIXDKQEQLMHOF4U46AQ47W524UIM/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1181400","label":"bugzilla.suse.com/1181400","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1188470","label":"bugzilla.suse.com/1188470","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1195188","label":"bugzilla.suse.com/1195188","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36740","label":"www.suse.com/security/cve/CVE-2021-36740","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23959","label":"www.suse.com/security/cve/CVE-2022-23959","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2021-36740","CVE-2022-23959"],"downstream":[],"duplicates":[],"related":["CVE-2021-36740","CVE-2022-23959"]},"timeline":[{"kind":"published","date":"2022-05-27T04:23:45.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T02:24:01.692Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T19:56:23.078Z","stale":false,"partial":false}}