Skip to content
OpenAdvisories
Medium RHSA-2024:4861 2 CVEs

Red Hat Security Advisory: squid security update

Published Sep 16, 2024 · Updated Mar 18, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream squid 7:5.5-13.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream squid-debuginfo 7:5.5-13.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream squid-debugsource 7:5.5-13.el9_4

Vulnerabilities 2

  • Medium 6.5
    CVE-2024-23638 EPSS 60%

    SQUID-2023:11 Denial of Service in Cache Manager

    Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2024-37894

    Squid vulnerable to heap corruption in ESI assign

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2260051
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2294353
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4861.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-23638
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-23638
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-23638
  • article
    http://www.squid-cache.org/Versions/v5/SQUID-2023_11.patch
  • article
    http://www.squid-cache.org/Versions/v6/SQUID-2023_11.patch
  • article
    https://github.com/squid-cache/squid/commit/290ae202883ac28a48867079c2fb34c40efd382b
  • article
    https://github.com/squid-cache/squid/commit/e8118a7381213f5cfcdeb4cec1d2d854bfd261c8
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-j49p-553x-48rx
  • article
    https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
  • report
    https://access.redhat.com/security/cve/CVE-2024-37894
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-37894
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-37894
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg
  • article
    https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html