Skip to content
OpenAdvisories
High ALSA-2024:0046 4 CVEs

Important: squid:4 security update

Published Jan 3, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

* squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)
* squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)
* squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)
* squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 5

ReleasePackageFixed in
AlmaLinux · 8 libecap 1.0.1-2.module_el8.6.0+2741+01592ae8
AlmaLinux · 8 libecap 1.0.1-2.module_el8.6.0+3048+383bc947
AlmaLinux · 8 libecap-devel 1.0.1-2.module_el8.6.0+2741+01592ae8
AlmaLinux · 8 libecap-devel 1.0.1-2.module_el8.6.0+3048+383bc947
AlmaLinux · 8 squid 7:4.15-7.module_el8.9.0+3708+6acaac63.5

Vulnerabilities 4

  • High 8.6
    CVE-2023-46724

    SQUID-2023:4 Denial of Service in SSL Certificate validation

    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49285 EPSS 88%

    Denial of Service in HTTP Message Processing in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49286 EPSS 10%

    Denial of Service in Helper Process management

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-46728

    SQUID-2021:8 Denial of Service in Gopher gateway

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid pr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-46724
  • report
    https://access.redhat.com/security/cve/CVE-2023-46728
  • report
    https://access.redhat.com/security/cve/CVE-2023-49285
  • report
    https://access.redhat.com/security/cve/CVE-2023-49286
  • report
    https://bugzilla.redhat.com/2247567
  • report
    https://bugzilla.redhat.com/2248521
  • report
    https://bugzilla.redhat.com/2252923
  • report
    https://bugzilla.redhat.com/2252926
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-0046.html