Summary
[7:3.5.20-17.0.5.13]
- Fixed cve 2023-46846 for http and icap request/response smuggling [Orabug: 37326730]
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | squid | 7:3.5.20-17.0.5.el7_9.13 |
| Oracle Linux · 7 | squid-migration-script | 7:3.5.20-17.0.5.el7_9.13 |
| Oracle Linux · 7 | squid-sysvinit | 7:3.5.20-17.0.5.el7_9.13 |
Vulnerabilities 1
-
Critical 9.3
Squid: request/response smuggling in http/1.1 and icap
SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.