Summary
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
Security Fix(es):
* squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638)
* squid: Denial of Service processing ESI response content (CVE-2024-45802)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | libecap | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| AlmaLinux · 8 | libecap | 1.0.1-2.module_el8.6.0+3048+383bc947 |
| AlmaLinux · 8 | libecap-devel | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| AlmaLinux · 8 | libecap-devel | 1.0.1-2.module_el8.6.0+3048+383bc947 |
| AlmaLinux · 8 | squid | 7:4.15-10.module_el8.10.0+3916+ed00a4a0.3 |
Vulnerabilities 2
-
High 7.5CVE-2024-45802 EPSS 46%
Squid Denial of Service
Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Den…
-
Medium 6.5CVE-2024-23638 EPSS 60%
SQUID-2023:11 Denial of Service in Cache Manager
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when…