Skip to content
OpenAdvisories
High ALAS2-2024-2500 1 CVE

Important: squid security update (Amazon Linux 2)

Published Mar 13, 2024 · Updated Mar 18, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-49285: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 squid 7:3.5.20-17.amzn2.7.19
Amazon Linux · 2 squid-debuginfo 7:3.5.20-17.amzn2.7.19
Amazon Linux · 2 squid-migration-script 7:3.5.20-17.amzn2.7.19
Amazon Linux · 2 squid-sysvinit 7:3.5.20-17.amzn2.7.19

Vulnerabilities 1

  • High 8.6
    CVE-2023-49285 EPSS 88%

    Denial of Service in HTTP Message Processing in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-49285.html