Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41318: A flaw was found in Squid. An incorrect integer overflow protection in the Squid SSPI and SMB authentication helpers is vulnerable to a buffer overflow attack, resulting in information disclosure or a denial of service. CVE-2021-46784: In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | squid | 7:3.5.20-17.amzn2.7.1 |
| Amazon Linux · 2 | squid-debuginfo | 7:3.5.20-17.amzn2.7.1 |
| Amazon Linux · 2 | squid-migration-script | 7:3.5.20-17.amzn2.7.1 |
| Amazon Linux · 2 | squid-sysvinit | 7:3.5.20-17.amzn2.7.1 |
Vulnerabilities 2
-
High 8.6
A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection…
-
Unscored —
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Servi…