Skip to content
OpenAdvisories
Unscored CVE-2014-9749 EUVD-2014-9555GHSA-4g27-gq63-x5mg

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access…

Published Nov 6, 2015 · Updated Aug 6, 2024 · Assigned by mitre

Description

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP2 squid 3.5.21-25.1 SUSE-SU-2017:0128-1
SLES 12 SP1 squid 3.3.14-22.6.1 SUSE-SU-2017:0116-1
SLES 11 SP4 squid 2.7.STABLE5-2.12.24.2 SUSE-SU-2015:1983-1
SLES 11 SP4 squid3 3.1.23-8.16.36.1 SUSE-SU-2017:0110-1
SLES 11 SP3 squid 2.7.STABLE5-2.12.24.2 SUSE-SU-2015:1983-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP2 squid 3.5.21-25.1 SUSE-SU-2017:0128-1
SLES for SAP 12 SP1 squid 3.3.14-22.6.1 SUSE-SU-2017:0116-1
SLES for SAP 11 SP4 squid 2.7.STABLE5-2.12.24.2 SUSE-SU-2015:1983-1
SLES for SAP 11 SP4 squid3 3.1.23-8.16.36.1 SUSE-SU-2017:0110-1
SLES for SAP 11 SP3 squid 2.7.STABLE5-2.12.24.2 SUSE-SU-2015:1983-1

Advisories 4

References