tocsin

Debian/varnish: critical 9.8

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or auth

Action: Upgrade varnish to 7.7.0-3+deb13u2 or later.

Affected

introducedfixedlast affected
07.7.0-3+deb13u2-

Fixed versions

7.7.0-3+deb13u2

Sources

published · modified · JSON