Denial of Service in HTTP Message Processing in Squid
43Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 88%
exploitation probability
88%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
1 product (4 components)
Red Hat Enterprise Linux 6
workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Fixed
16 products (265 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v.8.6) · Red Hat Enterprise Linux AppStream EUS (v.8.8) · Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · and others 11
In short
Squid proxy has a bug that allows attackers to crash the service by sending specially crafted HTTP messages. This causes the web caching service to stop working for all users.
Technical detail
A buffer overread vulnerability in Squid's HTTP message parsing enables remote attackers to trigger a denial of service condition. The vulnerability requires sending malformed HTTP requests to the affected proxy service, resulting in process termination or service unavailability.
Summary generated and translated by AI from the official description.
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected products
squid-cache · squidReferences
https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521bhttps://github.com/squid-cache/squid/commit/deee944f9a12c9fd399ce52f3e2526bb573a9470https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9https://lists.debian.org/debian-lts-announce/2024/01/msg00003.htmlhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/https://security.netapp.com/advisory/ntap-20240119-0004/http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patchhttp://www.squid-cache.org/Versions/v6/SQUID-2023_7.patch