Skip to content
OpenAdvisories
High ELSA-2024-9644 2 CVEs

Important: squid security update (Oracle Linux 8)

Published Nov 15, 2024 · Updated Nov 15, 2024

Ecosystem: Oracle Linux

Summary

libecap
squid
[7:4.15-10.3]
- Resolves: RHEL-22593 - CVE-2024-23638 squid:4/squid: vulnerable to
a Denial of Service attack against Cache Manager error responses

[7:4.15-10.2]
- Disable ESI support
- Resolves: RHEL-65075 - CVE-2024-45802 squid:4/squid: Denial of Service
processing ESI response content

[7:4.15-10.1]
- Resolves: RHEL-56024 - (Regression) Transfer-encoding:chunked data is not sent
to the client in its complementary

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 libecap 0:1.0.1-2.module+el8.9.0+90083+f7556140
Oracle Linux · 8 libecap-devel 0:1.0.1-2.module+el8.9.0+90083+f7556140
Oracle Linux · 8 squid 7:4.15-10.module+el8.10.0+90442+8ef3f586.3

Vulnerabilities 2

  • High 7.5
    CVE-2024-45802 EPSS 46%

    Squid Denial of Service

    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Den…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2024-23638 EPSS 60%

    SQUID-2023:11 Denial of Service in Cache Manager

    Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux