Skip to content
OpenAdvisories
High RHSA-2024:1787 6 CVEs

Red Hat Security Advisory: squid security update

Published Sep 16, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::server squid 7:3.5.20-17.el7_9.10
Red Hat · RHEL 7 enterprise_linux:7::server squid-debuginfo 7:3.5.20-17.el7_9.10
Red Hat · RHEL 7 enterprise_linux:7::server squid-migration-script 7:3.5.20-17.el7_9.10
Red Hat · RHEL 7 enterprise_linux:7::server squid-sysvinit 7:3.5.20-17.el7_9.10
Red Hat · RHEL 7 enterprise_linux:7::workstation squid 7:3.5.20-17.el7_9.10
Red Hat · RHEL 7 enterprise_linux:7::workstation squid-debuginfo 7:3.5.20-17.el7_9.10
Red Hat · RHEL 7 enterprise_linux:7::workstation squid-migration-script 7:3.5.20-17.el7_9.10
Red Hat · RHEL 7 enterprise_linux:7::workstation squid-sysvinit 7:3.5.20-17.el7_9.10

Vulnerabilities 6

  • High 8.6
    CVE-2023-46724

    SQUID-2023:4 Denial of Service in SSL Certificate validation

    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49285 EPSS 88%

    Denial of Service in HTTP Message Processing in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49286 EPSS 10%

    Denial of Service in Helper Process management

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-50269 EPSS 58%

    SQUID-2023:10 Denial of Service in HTTP Request parsing

    Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This …

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-46728

    SQUID-2021:8 Denial of Service in Gopher gateway

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid pr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2024-25617 EPSS 88%

    Denial of Service in HTTP Header parser in squid proxy

    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2247567
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2248521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252923
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252926
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2254663
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2264309
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1787.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-46724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-46724
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-46724
  • article
    http://www.squid-cache.org/Versions/v5/SQUID-2023_4.patch
  • article
    http://www.squid-cache.org/Versions/v6/SQUID-2023_4.patch
  • article
    https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-73m6-jm96-c6r3
  • report
    https://access.redhat.com/security/cve/CVE-2023-46728
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-46728
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-46728
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-cg5h-v6vc-w33f
  • article
    https://megamansec.github.io/Squid-Security-Audit/gopher-nullpointer.html
  • report
    https://access.redhat.com/security/cve/CVE-2023-49285
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49285
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49285
  • report
    https://access.redhat.com/security/cve/CVE-2023-49286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49286
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49286
  • report
    https://access.redhat.com/security/cve/CVE-2023-50269
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50269
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50269
  • article
    http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch
  • article
    http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3
  • report
    https://access.redhat.com/security/cve/CVE-2024-25617
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-25617
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-25617
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-h5x6-w8mv-xfpr
  • article
    https://megamansec.github.io/Squid-Security-Audit/response-memleaks.html