Skip to content
OpenAdvisories
Medium ALAS2-2024-2609 1 CVE

Moderate: squid security update (Amazon Linux 2)

Published Aug 1, 2024 · Updated Aug 13, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-37894: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 squid 7:3.5.20-17.amzn2.7.21
Amazon Linux · 2 squid-debuginfo 7:3.5.20-17.amzn2.7.21
Amazon Linux · 2 squid-migration-script 7:3.5.20-17.amzn2.7.21
Amazon Linux · 2 squid-sysvinit 7:3.5.20-17.amzn2.7.21

Vulnerabilities 1

  • Medium 6.3
    CVE-2024-37894

    Squid vulnerable to heap corruption in ESI assign

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-37894.html