it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
- From: Salvatore Bonaccorso <carnil AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 5334-1] varnish security update
- Date: Sun, 29 Jan 2023 21:13:52 +0000
- Authentication-results: mail.piratenpartei.de; dkim=none; spf=none (mail.piratenpartei.de: domain of "bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org" has no SPF policy when checking 82.195.75.100) smtp.mailfrom="bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org"; dmarc=none
- List-archive: https://lists.debian.org/msgid-search/E1pMEzo-002Xu5-SU AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Date:Message-Id:Subject:To:From:Reply-To:Cc:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=KPhXfe6X44th9T8q8RpHyrjHUNnKnGVm23/GR8e8gvg=; b=fe +O4xBCngxFCHdnX1Bl1T94xrMIwkZP1Dx8ftNhlDNnCwcFYiwSI04FmwDFOYOYuk5sp4KvEgQ6c/w cYPuFuyUILA8FpWz4StJuW42hG+qkMpudKCFV+neEFJsl42/dF7AFQsPLxL6nyu3atfXa+/wXHgya e2gSii9ZZpagI2AYqQSePv4987Mh9OMGF7HMoSjK3j6J4aQSnaQ2R2T+gmNBcdf3ZJ4vXnDSiiQiU bs9nNpKdBKgnn9bBd4BuLZ7KkKz6dmhHLIKtF1PUE8RZ7dDpvpm/W8iB67MAV8DVrrQnbrG3TdkFc yABXcP1c7yvxaF1L4y14ysKjUkK1a8lg==;
- Old-return-path: <carnil AT seger.debian.org>
- Priority: urgent
- Resent-date: Sun, 29 Jan 2023 21:14:19 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <jXysbX-sIkL.A.chE.rGu1jB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5334-1 security AT debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 29, 2023 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : varnish
CVE ID : CVE-2022-45060
Debian Bug : 1023751
Martin van Kervel Smedshammer discovered that varnish, a state of the
art, high-performance web accelerator, is prone to a HTTP/2 request
forgery vulnerability.
See https://varnish-cache.org/security/VSV00011.html for details.
For the stable distribution (bullseye), this problem has been fixed in
version 6.5.1-1+deb11u3.
We recommend that you upgrade your varnish packages.
For the detailed security status of varnish please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/varnish
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmPW4PxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0R2Xw//ezfXNoVdUw/N3ym0RS/2RBEjxmyC4tSBihh9xNV/rMr4ez/CqNC5iH2m
RYBjcEopyKZpuPiakY3eQC8Erk5TPo4Ky4zv9WPCyzV7a/nBe+bTdkL5VKciouS/
tG2B4tHaCTy3oGf6gUV3hJOruNDtJCFxpl3hfADT95wIZ9rKZpP4eSJ7YvU1Sml4
ZUenM73WbNP6UUzXXEcpfZbvraBs4l+SDxHrUR4t3MRAX0KXgXPVGD7dhb14A8XK
fLX+I7TS6tOgVApagnaH8xCY6+gk3UCyzgWmCkITCvYZOyYNHBoB1hHbIxvJ9Phh
KimdMpEwKjGNM+g974j4uOlLQlHDYo0dZIIncBICjbvB/7BgiictilcgcwcnlCof
XqroJwzQS/B1K0Pk8tc6Ok/xt9k2QqRru8vYI8CcgxcdpfkVodgnPU/bSbq6a8gF
NY4ZJQzVPbcg0Yjw7T0pzZjTnGpBchywzCf2ZOxVyeTNhSCEryhahYuYAJJR029f
hPP4brhV0taAthorwc/AdNSdUHnO+2rrcEgpUuBArBku7n4f4dtSixcnWtr9IFDb
xW3wr3LINgdNQAtPxlJuMdaI83eeTFMETztROhBt9SGI88Cn0UUC026hs5Osy+m6
aHaRq6wAyqjlcf72NDIlu6UAAtc60yUvTIH9VvNKuPr6fQXbEUw=
=wFUO
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 5334-1] varnish security update, Salvatore Bonaccorso, 29.01.2023
Archiv bereitgestellt durch MHonArc 2.6.24.