Skip to content
OpenAdvisories
High ALAS2-2023-1907 2 CVEs

Important: squid security update (Amazon Linux 2)

Published Jan 18, 2023 · Updated Jan 20, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41318: A flaw was found in Squid. An incorrect integer overflow protection in the Squid SSPI and SMB authentication helpers is vulnerable to a buffer overflow attack, resulting in information disclosure or a denial of service. CVE-2021-46784: In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 squid 7:3.5.20-17.amzn2.7.1
Amazon Linux · 2 squid-debuginfo 7:3.5.20-17.amzn2.7.1
Amazon Linux · 2 squid-migration-script 7:3.5.20-17.amzn2.7.1
Amazon Linux · 2 squid-sysvinit 7:3.5.20-17.amzn2.7.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46784.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-41318.html