The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2ff6e32273 advisory. Automatic update for varnish-7.7.3-2.fc44. ##### **Changelog** ``` * Wed Oct 29 2025 Lubo Uhliarik - 7.7.3-2 - Add tmpfiles.d rules for /var directories (bootc compatibility) * Mon Sep 15 2025 Ingvar Hagelund - 7.7.3-1 - New upstream release: A security release - Includes fix for VSV00017 aka CVE-2025-8671, rhbz#2388222 * Thu Jul 31 2025 Lubo Uhliarik - 7.7.1-4 - bundle jemalloc in RHEL * Fri Jul 25 2025 Fedora Release Engineering - 7.7.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu May 22 2025 Ingvar Hagelund - 7.7.1-2 - Correct ABI and VRT versions - Pulled el7 support - Use systemd setup for users * Tue May 20 2025 Lubo Uhliarik - 7.7.1-1 - new version 7.7.1 * Thu Mar 27 2025 Ingvar Hagelund - 7.7.0-2 - Fix for eln build (merged from yselkowitz) - Fix for failing h2 switch check. Enabling full test suite again * Mon Mar 24 2025 Ingvar Hagelund - 7.7.0-1 - New upstream release - fedora now has completed the bin/sbin merge * Sun Jan 19 2025 Fedora Release Engineering - 7.6.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Mon Dec 2 2024 Ingvar Hagelund - 7.6.1-1 - New upstream release * Mon Sep 16 2024 Ingvar Hagelund - 7.6.0-1 - New upstream release - Updated checkout of pkg-varnish * Sat Jul 20 2024 Fedora Release Engineering - 7.5.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Tue Mar 19 2024 Ingvar Hagelund - 7.5.0-1 - New upstream release - Moved somethings around to make the diff from the upstream spec less - Upped some memory requirements in some of the tests. Necessary on aarch64 and ppc64le (and ppc32) - Reduced number of parallel jobs on s390x builders as builds tend to fail when stressed - Retired armv7hl * Sat Jan 27 2024 Fedora Release Engineering - 7.4.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Wed Nov 8 2023 Ingvar Hagelund - 7.4.2-1 - New upstream release. A security release - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack ``` Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
249328	FreeBSD : www/varnish7 -- Denial of Service in HTTP/2 (e2d49973-785a-11f0-a1c0-0050569f0b83)	Nessus	FreeBSD Local Security Checks	8/14/2025	8/14/2025	high
272039	Fedora 44 : varnish (2025-2ff6e32273)	Nessus	Fedora Local Security Checks	10/30/2025	10/31/2025	medium
260016	Linux Distros Unpatched Vulnerability : CVE-2025-8671	Nessus	Misc.	8/31/2025	10/27/2025	high

Detections

Analytics

Plugins Search

high

medium

high