Detections
Analytics

Fedora 44 : varnish (2025-2ff6e32273)

medium Nessus Plugin ID 272039

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2ff6e32273 advisory.

 Automatic update for varnish-7.7.3-2.fc44.

 ##### **Changelog**

 ```
 * Wed Oct 29 2025 Lubo Uhliarik <[email protected]> - 7.7.3-2
 - Add tmpfiles.d rules for /var directories (bootc compatibility)
 * Mon Sep 15 2025 Ingvar Hagelund <[email protected]> - 7.7.3-1
 - New upstream release: A security release
 - Includes fix for VSV00017 aka CVE-2025-8671, rhbz#2388222
 * Thu Jul 31 2025 Lubo Uhliarik <[email protected]> - 7.7.1-4
 - bundle jemalloc in RHEL
 * Fri Jul 25 2025 Fedora Release Engineering <[email protected]> - 7.7.1-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 * Thu May 22 2025 Ingvar Hagelund <[email protected]> - 7.7.1-2
 - Correct ABI and VRT versions
 - Pulled el7 support
 - Use systemd setup for users
 * Tue May 20 2025 Lubo Uhliarik <[email protected]> - 7.7.1-1
 - new version 7.7.1
 * Thu Mar 27 2025 Ingvar Hagelund <[email protected]> - 7.7.0-2
 - Fix for eln build (merged from yselkowitz)
 - Fix for failing h2 switch check. Enabling full test suite again
 * Mon Mar 24 2025 Ingvar Hagelund <[email protected]> - 7.7.0-1
 - New upstream release
 - fedora now has completed the bin/sbin merge
 * Sun Jan 19 2025 Fedora Release Engineering <[email protected]> - 7.6.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 * Mon Dec 2 2024 Ingvar Hagelund <[email protected]> - 7.6.1-1
 - New upstream release
 * Mon Sep 16 2024 Ingvar Hagelund <[email protected]> - 7.6.0-1
 - New upstream release
 - Updated checkout of pkg-varnish
 * Sat Jul 20 2024 Fedora Release Engineering <[email protected]> - 7.5.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 * Tue Mar 19 2024 Ingvar Hagelund <[email protected]> - 7.5.0-1
 - New upstream release
 - Moved somethings around to make the diff from the upstream spec less
 - Upped some memory requirements in some of the tests. Necessary on aarch64 and ppc64le (and ppc32)
 - Reduced number of parallel jobs on s390x builders as builds tend to fail when stressed
 - Retired armv7hl
 * Sat Jan 27 2024 Fedora Release Engineering <[email protected]> - 7.4.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Wed Nov 8 2023 Ingvar Hagelund <[email protected]> - 7.4.2-1
 - New upstream release. A security release
 - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack

 ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected varnish package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2025-2ff6e32273

Plugin Details

Severity: Medium

ID: 272039

File Name: fedora_2025-2ff6e32273.nasl

Version: 1.1

Type: local

Agent: unix

Published: 10/30/2025

Updated: 10/30/2025

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.1

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-44487

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:varnish, cpe:/o:fedoraproject:fedora:44

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/30/2025

Vulnerability Publication Date: 10/10/2023

CISA Known Exploited Vulnerability Due Dates: 10/31/2023

Reference Information

CVE: CVE-2023-44487, CVE-2025-8671