[ALAS2-2024-2509] Amazon Linux 2 2017.12 - ALAS2-2024-2509: important priority package update for squid

Severity Important

Affected Packages 12

CVEs 2

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:
CVE-2023-46846:
Due to chunked decoder lenience Squid is vulnerable to Request/Response smuggling attacks when parsing HTTP/1.1 and ICAP messages.

CVE-2019-12521:
A flaw was found in squid. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.

Package	Affected Version
pkg:rpm/amazonlinux/squid?arch=x86_64&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid?arch=i686&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid?arch=aarch64&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-sysvinit?arch=x86_64&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-sysvinit?arch=i686&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-sysvinit?arch=aarch64&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-migration-script?arch=x86_64&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-migration-script?arch=i686&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-migration-script?arch=aarch64&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-debuginfo?arch=x86_64&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-debuginfo?arch=i686&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20
pkg:rpm/amazonlinux/squid-debuginfo?arch=aarch64&distro=amazonlinux-2	< 3.5.20-17.amzn2.7.20

ID

ALAS2-2024-2509

Severity

important

URL

https://alas.aws.amazon.com/AL2/ALAS-2024-2509.html

Published

2024-03-27T21:32:00
(5 months ago)

Modified

2024-03-27T21:32:00
(5 months ago)

Rights

Amazon Linux Security Team

Other Advisories

Source	# ID	Name	URL
CVE	CVE-2019-12521		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12521
CVE	CVE-2023-46846		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46846

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch
Affected	pkg:rpm/amazonlinux/squid?arch=x86_64&distro=amazonlinux-2	amazonlinux	squid	< 3.5.20-17.amzn2.7.20	amazonlinux-2	x86_64
Affected	pkg:rpm/amazonlinux/squid?arch=i686&distro=amazonlinux-2	amazonlinux	squid	< 3.5.20-17.amzn2.7.20	amazonlinux-2	i686
Affected	pkg:rpm/amazonlinux/squid?arch=aarch64&distro=amazonlinux-2	amazonlinux	squid	< 3.5.20-17.amzn2.7.20	amazonlinux-2	aarch64
Affected	pkg:rpm/amazonlinux/squid-sysvinit?arch=x86_64&distro=amazonlinux-2	amazonlinux	squid-sysvinit	< 3.5.20-17.amzn2.7.20	amazonlinux-2	x86_64
Affected	pkg:rpm/amazonlinux/squid-sysvinit?arch=i686&distro=amazonlinux-2	amazonlinux	squid-sysvinit	< 3.5.20-17.amzn2.7.20	amazonlinux-2	i686
Affected	pkg:rpm/amazonlinux/squid-sysvinit?arch=aarch64&distro=amazonlinux-2	amazonlinux	squid-sysvinit	< 3.5.20-17.amzn2.7.20	amazonlinux-2	aarch64
Affected	pkg:rpm/amazonlinux/squid-migration-script?arch=x86_64&distro=amazonlinux-2	amazonlinux	squid-migration-script	< 3.5.20-17.amzn2.7.20	amazonlinux-2	x86_64
Affected	pkg:rpm/amazonlinux/squid-migration-script?arch=i686&distro=amazonlinux-2	amazonlinux	squid-migration-script	< 3.5.20-17.amzn2.7.20	amazonlinux-2	i686
Affected	pkg:rpm/amazonlinux/squid-migration-script?arch=aarch64&distro=amazonlinux-2	amazonlinux	squid-migration-script	< 3.5.20-17.amzn2.7.20	amazonlinux-2	aarch64
Affected	pkg:rpm/amazonlinux/squid-debuginfo?arch=x86_64&distro=amazonlinux-2	amazonlinux	squid-debuginfo	< 3.5.20-17.amzn2.7.20	amazonlinux-2	x86_64
Affected	pkg:rpm/amazonlinux/squid-debuginfo?arch=i686&distro=amazonlinux-2	amazonlinux	squid-debuginfo	< 3.5.20-17.amzn2.7.20	amazonlinux-2	i686
Affected	pkg:rpm/amazonlinux/squid-debuginfo?arch=aarch64&distro=amazonlinux-2	amazonlinux	squid-debuginfo	< 3.5.20-17.amzn2.7.20	amazonlinux-2	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date