ASA-202107-28 log generated external raw

[ASA-202107-28] varnish: url request injection
Arch Linux Security Advisory ASA-202107-28 ========================================== Severity: Medium Date : 2021-07-14 CVE-ID : CVE-2021-36740 Package : varnish Type : url request injection Remote : Yes Link : Summary ======= The package varnish before version 6.6.1-1 is vulnerable to url request injection. Resolution ========== Upgrade to 6.6.1-1. # pacman -Syu "varnish>=6.6.1-1" The problem has been fixed upstream in version 6.6.1. Workaround ========== The issue can be mitigated by turning off support for HTTP/2, using sudo varnishadm param.set feature -http2 or by preventing connection reuse with the following configuration: sub vcl_backend_fetch { set bereq.http.Connection = "close"; } Description =========== Varnish Cache before version 6.6.1, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. Impact ====== A remote attacker could inject arbitrary HTTP requests through an HTTP/2 POST request with a large Content-Length header. References ==========