Skip to content
OpenAdvisories
High ELSA-2024-1376 3 CVEs

Important: squid security update (Oracle Linux 9)

Published Mar 20, 2024 · Updated Mar 20, 2024

Ecosystem: Oracle Linux

Summary

[7:5.5-6.0.1.8]
- Rebuild with release bump

[7:5.5-6.8]
- Resolves: RHEL-19555 - squid: denial of service in HTTP request
parsing (CVE-2023-50269)

[7:5.5-6.7]
- Resolves: RHEL-28614 - squid: Denial of Service in HTTP Chunked
Decoding (CVE-2024-25111)

[7:5.5-6.6]
- Resolves: RHEL-26091 - squid: denial of service in HTTP header
parser (CVE-2024-25617)

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 squid 7:5.5-6.0.1.el9_3.8

Vulnerabilities 3

  • High 8.6
    CVE-2023-50269 EPSS 58%

    SQUID-2023:10 Denial of Service in HTTP Request parsing

    Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This …

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2024-25111 EPSS 65%

    SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

    Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of …

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2024-25617 EPSS 88%

    Denial of Service in HTTP Header parser in squid proxy

    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux