Skip to content
OpenAdvisories
Medium ALAS2023-2024-687 1 CVE

Moderate: squid security update (Amazon Linux 2023)

Published Aug 1, 2024 · Updated Aug 6, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-37894: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 squid 7:6.6-1.amzn2023.0.4
Amazon Linux · 2023 squid-debuginfo 7:6.6-1.amzn2023.0.4
Amazon Linux · 2023 squid-debugsource 7:6.6-1.amzn2023.0.4

Vulnerabilities 1

  • Medium 6.3
    CVE-2024-37894

    Squid vulnerable to heap corruption in ESI assign

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-37894.html