squid - security update

Fixed packages 2

Vulnerabilities 8

• Critical 9.3
  CVE-2023-46846

  Squid: request/response smuggling in http/1.1 and icap

  SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  Nov 3, 2023
• High 8.6
  CVE-2023-46724

  SQUID-2023:4 Denial of Service in SSL Certificate validation

  Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation…

  squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  Nov 1, 2023
• High 8.6
  CVE-2023-46847 EPSS 79%

  Squid: denial of service in http digest authentication

  Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 3, 2023
• High 8.6
  CVE-2023-49285 EPSS 88%

  Denial of Service in HTTP Message Processing in Squid

  Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…

  squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  Dec 4, 2023
• High 8.6
  CVE-2023-49286 EPSS 10%

  Denial of Service in Helper Process management

  Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…

  squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  Dec 4, 2023
• High 8.6
  CVE-2023-50269 EPSS 58%

  SQUID-2023:10 Denial of Service in HTTP Request parsing

  Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This …

  squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  Dec 14, 2023
• Medium 6.5
  CVE-2024-23638 EPSS 60%

  SQUID-2023:11 Denial of Service in Cache Manager

  Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when…

  squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  Jan 23, 2024
• Medium 5.3
  CVE-2024-25617 EPSS 88%

  Denial of Service in HTTP Header parser in squid proxy

  Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or…

  squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  Feb 14, 2024