# changelog

author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 6.0.0-1
changelog:
  - New upstream release
  - Added a patch that fixes _FORTIFY_SOURCE=2 on copr/el6
  - Added a patch fixing compilation on epel6
  - Fresh checkout of pkg-varnish-cache
  - Updated find-requires sed fix to update variant and moved it to prep
  - Removed -libs subpackage
  - varnish_reload_vcl changed name to varnishreload, as in upstream
  - varnish.params is gone. To override startup configuration,
    use /etc/systemd/system/varnish.service
  - Dropped patch and sed fixes for find-provides, as it is fixed upstream
  - Dropped patch for test vsv00002, as it is fixed upstream
  - Droppet patch for python3, as it is included upstream
  - Dropped buildreq on groff, as tarball includes prebuilt manpages
  - Dropped systemv to systemd helpers
  - Updated project url
  - Use prebuilt html files for docs subpackage
  - Dropped unnecessary explicit require of initscripts, closes #1592398


author: Lubos Uhliarik <luhliari@redhat.com> - 6.0.6-2
changelog:
  - new version 6.0.6
  - Resolves: #1795673 - RFE: rebase varnish:6 to latest 6.0.x LTS
  - Resolves: #1790907 - CVE-2019-20637 varnish: not clearing pointer between two
    client requests leads to information disclosure
  - Resolves: #1763958 - CVE-2019-15892 varnish:6/varnish: denial of service 
    handling certain crafted HTTP/1 requests


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.8-1
changelog:
  - new version 6.0.8
  - Resolves: #1982862 - CVE-2021-36740 varnish:6/varnish: HTTP/2 request
    smuggling attack via a large Content-Length header for a POST request


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.8-2
changelog:
  - Resolves: #2047650 - CVE-2022-23959 varnish:6/varnish: Varnish HTTP/1 Request
    Smuggling Vulnerability


author: Tomas Korbar <tkorbar@redhat.com> - 6.0.8-3.1
changelog:
  - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487
  - Resolves: RHEL-12814


