Skip to content
OpenAdvisories
High ALAS2-2023-2063 1 CVE

Important: squid security update (Amazon Linux 2)

Published May 25, 2023 · Updated Jun 1, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14058: An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 squid 7:3.5.20-17.amzn2.7.3
Amazon Linux · 2 squid-debuginfo 7:3.5.20-17.amzn2.7.3
Amazon Linux · 2 squid-migration-script 7:3.5.20-17.amzn2.7.3
Amazon Linux · 2 squid-sysvinit 7:3.5.20-17.amzn2.7.3

Vulnerabilities 1

  • Unscored —
    CVE-2020-14058

    An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squi…

    squid Debian

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-14058.html