git: 81c93e4aa6e0 - main - security/vuxml: Add Varnish Cache vulnerability

From: Danilo G. Baio <dbaio_at_FreeBSD.org>
Date: Mon, 12 May 2025 23:13:15 UTC 
The branch main has been updated by dbaio:

URL: https://cgit.FreeBSD.org/ports/commit/?id=81c93e4aa6e07c45b5fc520c91f7473cf5972d1a

commit 81c93e4aa6e07c45b5fc520c91f7473cf5972d1a
Author:     Danilo G. Baio <dbaio@FreeBSD.org>
AuthorDate: 2025-05-12 23:07:15 +0000
Commit:     Danilo G. Baio <dbaio@FreeBSD.org>
CommitDate: 2025-05-12 23:07:46 +0000

    security/vuxml: Add Varnish Cache vulnerability
---
 security/vuxml/vuln/2025.xml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index 3456123f0adf..8bcfd16d2c2e 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,35 @@
+  <vuln vid="89c668d5-2f80-11f0-9632-641c67a117d8">
+    <topic>www/varnish7 -- Request Smuggling Attack</topic>
+    <affects>
+      <package>
+	<name>varnish7</name>
+	<range><lt>7.7.1</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The Varnish Development Team reports:</p>
+	<blockquote cite="https://varnish-cache.org/security/VSV00016.html">
+	<p>A client-side desync vulnerability can be triggered in Varnish Cache
+	   and Varnish Enterprise. This vulnerability can be triggered under
+	   specific circumstances involving malformed HTTP/1 requests.</p>
+	<p>An attacker can abuse a flaw in Varnish's handling of chunked
+	   transfer encoding which allows certain malformed HTTP/1 requests
+	   to exploit improper framing of the message body to smuggle additional
+	   requests. Specifically, Varnish incorrectly permits CRLF to be
+	   skipped to delimit chunk boundaries.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <url>https://varnish-cache.org/security/VSV00016.html</url>
+    </references>
+    <dates>
+      <discovery>2025-05-12</discovery>
+      <entry>2025-05-12</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="a8a1a8e7-2e85-11f0-a989-b42e991fc52e">
     <topic>Mozilla -- memory corrupton</topic>
     <affects>