Skip to content
OpenAdvisories
Medium ALAS2-2024-2381 1 CVE

Moderate: squid security update (Amazon Linux 2)

Published Jan 3, 2024 · Updated Jan 9, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-49286: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 squid 7:3.5.20-17.amzn2.7.15
Amazon Linux · 2 squid-debuginfo 7:3.5.20-17.amzn2.7.15
Amazon Linux · 2 squid-migration-script 7:3.5.20-17.amzn2.7.15
Amazon Linux · 2 squid-sysvinit 7:3.5.20-17.amzn2.7.15

Vulnerabilities 1

  • High 8.6
    CVE-2023-49286 EPSS 10%

    Denial of Service in Helper Process management

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-49286.html