Skip to content
OpenAdvisories
Medium ALAS2-2023-2310 2 CVEs

Moderate: squid security update (Amazon Linux 2)

Published Oct 12, 2023 · Updated Oct 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19132: A memory leak was discovered in the way Squid handles SNMP denied queries. A remote attacker may use this flaw to exhaust the resources on the server machine. CVE-2018-19131: Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 squid 7:3.5.20-17.amzn2.7.8
Amazon Linux · 2 squid-debuginfo 7:3.5.20-17.amzn2.7.8
Amazon Linux · 2 squid-migration-script 7:3.5.20-17.amzn2.7.8
Amazon Linux · 2 squid-sysvinit 7:3.5.20-17.amzn2.7.8

Vulnerabilities 2

  • Unscored —
    CVE-2018-19131 Public exploit

    Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

    squid Debian
  • Unscored —
    CVE-2018-19132

    Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

    squid squid3 Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19131.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19132.html