Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
Varnish Cache on Red Hat Systems: Remote Code Execution
published 1 year ago
Summary
A security update is available for Varnish Cache on Red Hat systems. If left unpatched, an attacker could potentially execute malicious code on affected systems, compromising security and confidentiality. To protect your systems, apply the latest security update as soon as possible.
What to do
- Update redhat varnish to version 0:6.0.6-1.module+el8.2.0+23124+897a7786.1.
- Update redhat varnish-devel to version 0:6.0.6-1.module+el8.2.0+23124+897a7786.1.
- Update redhat varnish-docs to version 0:6.0.6-1.module+el8.2.0+23124+897a7786.1.
- Update redhat varnish-modules to version 0:0.15.0-4.module+el8+2481+4078e9d2.
- Update redhat varnish-modules-debuginfo to version 0:0.15.0-4.module+el8+2481+4078e9d2.
- Update redhat varnish-modules-debugsource to version 0:0.15.0-4.module+el8+2481+4078e9d2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_aus:8.2::appstream | redhat | varnish |
< 0:6.0.6-1.module+el8.2.0+23124+897a7786.1 Fix: upgrade to 0:6.0.6-1.module+el8.2.0+23124+897a7786.1
|
| Red Hat:rhel_aus:8.2::appstream | redhat | varnish-devel |
< 0:6.0.6-1.module+el8.2.0+23124+897a7786.1 Fix: upgrade to 0:6.0.6-1.module+el8.2.0+23124+897a7786.1
|
| Red Hat:rhel_aus:8.2::appstream | redhat | varnish-docs |
< 0:6.0.6-1.module+el8.2.0+23124+897a7786.1 Fix: upgrade to 0:6.0.6-1.module+el8.2.0+23124+897a7786.1
|
| Red Hat:rhel_aus:8.2::appstream | redhat | varnish-modules |
< 0:0.15.0-4.module+el8+2481+4078e9d2 Fix: upgrade to 0:0.15.0-4.module+el8+2481+4078e9d2
|
| Red Hat:rhel_aus:8.2::appstream | redhat | varnish-modules-debuginfo |
< 0:0.15.0-4.module+el8+2481+4078e9d2 Fix: upgrade to 0:0.15.0-4.module+el8+2481+4078e9d2
|
| Red Hat:rhel_aus:8.2::appstream | redhat | varnish-modules-debugsource |
< 0:0.15.0-4.module+el8+2481+4078e9d2 Fix: upgrade to 0:0.15.0-4.module+el8+2481+4078e9d2
|
Original advisory text
Red Hat Security Advisory: varnish:6 security update
References
- https://access.redhat.com/errata/RHSA-2025:8339 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2364235 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8339.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-47905 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-47905 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47905 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published2 Jun 2025
Updated12 Jul 2026
First seen12 Jul 2026
Sources
RHSA-2025:8339 · OSV
Track software like this
Free during beta