varnish - Debian Package Tracker

general

source: varnish (main)
version: 7.7.0-1
maintainer: Varnish Package Maintainers (DMD)
uploaders: Stig Sandbeck Mathisen [DMD] – Marco d'Itri [DMD]
arch: all any
std-ver: 4.7.2.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 6.1.1-1+deb10u3
o-o-sec: 6.1.1-1+deb10u4
oldstable: 6.5.1-1+deb11u3
old-sec: 6.5.1-1+deb11u3
stable: 7.1.1-1.1
testing: 7.6.1-2
unstable: 7.7.0-1

versioned links

6.1.1-1+deb10u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.1.1-1+deb10u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.5.1-1+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.1.1-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.6.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.7.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libvarnishapi-dev
libvarnishapi3
varnish
varnish-doc

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2025-30346: Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Created: 2025-03-21 Last update: 2025-03-22 04:01

3 security issues in bullseye high

There are 3 open security issues in bullseye.

1 important issue:

CVE-2025-30346: Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

2 ignored issues:

CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-30156: Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

Created: 2025-03-21 Last update: 2025-03-22 04:01

3 security issues in bookworm high

There are 3 open security issues in bookworm.

1 important issue:

CVE-2025-30346: Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

2 ignored issues:

CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-30156: Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

Created: 2023-11-17 Last update: 2025-03-22 04:01

3 security issues in buster high

There are 3 open security issues in buster.

2 important issues:

CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-30156: Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

1 issue postponed or untriaged:

CVE-2019-20637: (needs triaging) An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.

Created: 2023-11-17 Last update: 2024-04-05 18:00

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2025-03-23 Last update: 2025-03-25 13:33

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-03-19 Last update: 2025-03-19 12:03

debian/patches: 2 patches to forward upstream low

Among the 2 debian patches available in version 7.7.0-1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-03-19 09:03

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2024-07-20 Last update: 2024-07-20 05:48

testing migrations

excuses:
- Blocked by: varnish-modules
- Migrates after: libvmod-re2, libvmod-redis, libvmod-selector, varnish-vmod-digest
- Migration status for varnish (7.6.1-2 to 7.7.0-1): Waiting for another item to be ready to migrate (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Implicit dependency: varnish varnish-modules (not considered)
- ∙ ∙ Invalidated by implicit-dependency
- ∙ ∙ Implicit dependency: varnish libvmod-re2
- ∙ ∙ Implicit dependency: varnish libvmod-redis
- ∙ ∙ Implicit dependency: varnish libvmod-selector
- ∙ ∙ Implicit dependency: varnish varnish-vmod-digest
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/v/varnish.html
- ∙ ∙ autopkgtest for varnish/7.7.0-1: amd64: Pass, arm64: Pass, armel: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Reproducible on arm64 - info ♻
- ∙ ∙ Waiting for reproducibility test results on armhf - info ♻
- ∙ ∙ Reproducible on i386 - info ♻
- ∙ ∙ Required age reduced by 3 days because of autopkgtest
- ∙ ∙ 6 days old (needed 2 days)
- Not considered

news

[rss feed]

[2025-03-18] Accepted varnish 7.7.0-1 (source) into unstable (Marco d'Itri)
[2024-12-03] varnish 7.6.1-2 MIGRATED to testing (Debian testing watch)
[2024-11-29] Accepted varnish 7.6.1-2 (source) into unstable (Marco d'Itri)
[2024-11-18] Accepted varnish 7.6.1-1 (source) into experimental (Marco d'Itri)
[2024-10-27] varnish 7.6.0-2 MIGRATED to testing (Debian testing watch)
[2024-10-24] Accepted varnish 7.6.0-2 (source) into unstable (Marco d'Itri)
[2024-10-21] Accepted varnish 7.6.0-1 (source) into unstable (Marco d'Itri)
[2024-07-22] varnish 7.5.0-3 MIGRATED to testing (Debian testing watch)
[2024-07-19] Accepted varnish 7.5.0-3 (source) into unstable (Marco d'Itri)
[2024-07-09] varnish 7.5.0-2 MIGRATED to testing (Debian testing watch)
[2024-07-02] Accepted varnish 7.5.0-2 (source) into unstable (Marco d'Itri)
[2024-07-02] Accepted varnish 7.5.0-1 (source) into unstable (Marco d'Itri)
[2024-04-04] varnish 7.1.1-1.2 MIGRATED to testing (Debian testing watch)
[2024-04-01] Accepted varnish 7.1.1-1.2 (source) into unstable (Marco d'Itri)
[2023-12-23] varnish REMOVED from testing (Debian testing watch)
[2023-12-22] varnish REMOVED from testing (Debian testing watch)
[2023-01-31] Accepted varnish 6.5.1-1+deb11u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2023-01-29] Accepted varnish 6.5.1-1+deb11u3 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2023-01-18] varnish 7.1.1-1.1 MIGRATED to testing (Debian testing watch)
[2023-01-12] Accepted varnish 7.1.1-1.1 (source) into unstable (Salvatore Bonaccorso)
[2022-11-27] Accepted varnish 6.1.1-1+deb10u4 (source) into oldstable (Markus Koschany)
[2022-08-16] varnish 7.1.1-1 MIGRATED to testing (Debian testing watch)
[2022-08-12] Accepted varnish 7.1.1-1 (source) into unstable (Stig Sandbeck Mathisen)
[2022-06-20] varnish 7.1.0-6 MIGRATED to testing (Debian testing watch)
[2022-06-16] Accepted varnish 7.1.0-6 (source) into unstable (Stig Sandbeck Mathisen)
[2022-06-15] Accepted varnish 7.1.0-5 (all amd64 source) into unstable (Stig Sandbeck Mathisen)
[2022-06-14] Accepted varnish 7.1.0-4 (all amd64 source) into experimental, experimental (Debian FTP Masters) (signed by: Stig Sandbeck Mathisen)
[2022-05-06] varnish REMOVED from testing (Debian testing watch)
[2022-03-05] Accepted varnish 6.1.1-1+deb10u3 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Debian FTP Masters) (signed by: Florian Weimer)
[2022-03-05] Accepted varnish 6.1.1-1+deb10u2 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Debian FTP Masters) (signed by: Florian Weimer)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 7.7.0-1
10 bugs