Skip to content
OpenAdvisories
High RHSA-2024:0046 4 CVEs

Red Hat Security Advisory: squid:4 security update

Published Sep 16, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream libecap 0:1.0.1-2.module+el8.9.0+19703+a1da7223
Red Hat · RHEL 8 enterprise_linux:8::appstream libecap-debuginfo 0:1.0.1-2.module+el8.9.0+19703+a1da7223
Red Hat · RHEL 8 enterprise_linux:8::appstream libecap-debugsource 0:1.0.1-2.module+el8.9.0+19703+a1da7223
Red Hat · RHEL 8 enterprise_linux:8::appstream libecap-devel 0:1.0.1-2.module+el8.9.0+19703+a1da7223
Red Hat · RHEL 8 enterprise_linux:8::appstream squid 7:4.15-7.module+el8.9.0+20975+25f17541.5
Red Hat · RHEL 8 enterprise_linux:8::appstream squid-debuginfo 7:4.15-7.module+el8.9.0+20975+25f17541.5
Red Hat · RHEL 8 enterprise_linux:8::appstream squid-debugsource 7:4.15-7.module+el8.9.0+20975+25f17541.5

Vulnerabilities 4

  • High 8.6
    CVE-2023-46724

    SQUID-2023:4 Denial of Service in SSL Certificate validation

    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49285 EPSS 88%

    Denial of Service in HTTP Message Processing in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49286 EPSS 10%

    Denial of Service in Helper Process management

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-46728

    SQUID-2021:8 Denial of Service in Gopher gateway

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid pr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2247567
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2248521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252923
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252926
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0046.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-46724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-46724
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-46724
  • article
    http://www.squid-cache.org/Versions/v5/SQUID-2023_4.patch
  • article
    http://www.squid-cache.org/Versions/v6/SQUID-2023_4.patch
  • article
    https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-73m6-jm96-c6r3
  • report
    https://access.redhat.com/security/cve/CVE-2023-46728
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-46728
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-46728
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-cg5h-v6vc-w33f
  • article
    https://megamansec.github.io/Squid-Security-Audit/gopher-nullpointer.html
  • report
    https://access.redhat.com/security/cve/CVE-2023-49285
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49285
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49285
  • report
    https://access.redhat.com/security/cve/CVE-2023-49286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49286
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49286