Skip to content
OpenAdvisories
High ELSA-2024-0046 4 CVEs

Important: squid:4 security update (Oracle Linux 8)

Published Jan 4, 2024 · Updated Jan 4, 2024

Ecosystem: Oracle Linux

Summary

libecap
squid
[7:4.15-7.5]
- Fix squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)
- Fix squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)
- Fix squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)
- Fix squid: Incorrect Check of Function Return Value In Helper Process management(CVE-2023-49286)

[7:4.15-7.3]
- Fix squid: DoS against HTTP and HTTPS (CVE-2023-5824)

[7:4.15-7.1]
- Resolves: RHEL-14801 - squid: squid: Denial of Service in HTTP Digest
Authentication
- Resolves: RHEL-14776 - squid: squid: Request/Response smuggling in HTTP/1.1
and ICAP

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 libecap 0:1.0.1-2.module+el8.9.0+90083+f7556140
Oracle Linux · 8 libecap-devel 0:1.0.1-2.module+el8.9.0+90083+f7556140
Oracle Linux · 8 squid 7:4.15-7.module+el8.9.0+90111+615ac445.5

Vulnerabilities 4

  • High 8.6
    CVE-2023-46724

    SQUID-2023:4 Denial of Service in SSL Certificate validation

    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49285 EPSS 88%

    Denial of Service in HTTP Message Processing in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49286 EPSS 10%

    Denial of Service in Helper Process management

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-46728

    SQUID-2021:8 Denial of Service in Gopher gateway

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid pr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux