CVE-2022-38150: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-38150 affects Varnish Cache versions 7.0.0, 7.0.1, 7.0.2, and 7.1.0. The vulnerability was discovered in August 2022 and allows attackers to cause a denial of service condition in the Varnish Server through specially formatted reason phrases in backend response status lines (Varnish Security).

The vulnerability exists in the way Varnish Cache handles reason phrases in HTTP/1 responses from configured backends. When a specially crafted reason phrase starting with a colon is received from the backend, it can trigger an assertion in the Varnish Server, causing it to automatically restart (Varnish Security).

A successful exploitation of this vulnerability results in a denial of service condition where the Varnish Server asserts and automatically restarts, disrupting the normal caching and serving of web content (Varnish Security).

The vulnerability has been fixed in Varnish Cache versions 7.0.3 and 7.1.1. For systems unable to upgrade, a mitigation is available by adding a VCL snippet at the beginning of the vclbackendresponse function that resets the status code, which automatically sanitizes the reason field: set beresp.status = beresp.status; (Varnish Security, Fedora Update).

The vulnerability was first identified and reproduced by Anthony Schwartz, with the original test case and maintainer notification made by Guillaume Quintard (Varnish Security).