[USN-6500-1] Squid vulnerabilities

Severity High

Affected Packages 23

CVEs 5

Several security issues were fixed in Squid.

Joshua Rogers discovered that Squid incorrectly handled validating certain
SSL certificates. A remote attacker could possibly use this issue to cause
Squid to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-46724)

Joshua Rogers discovered that Squid incorrectly handled the Gopher
protocol. A remote attacker could possibly use this issue to cause Squid to
crash, resulting in a denial of service. Gopher support has been disabled
in this update. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, and Ubuntu 23.04. (CVE-2023-46728)

Keran Mu and Jianjun Chen discovered that Squid incorrectly handled the
chunked decoder. A remote attacker could possibly use this issue to perform
HTTP request smuggling attacks. (CVE-2023-46846)

Joshua Rogers discovered that Squid incorrectly handled HTTP Digest
Authentication. A remote attacker could possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2023-46847)

Joshua Rogers discovered that Squid incorrectly handled certain FTP urls.
A remote attacker could possibly use this issue to cause Squid to crash,
resulting in a denial of service. (CVE-2023-46848)

Package	Affected Version
pkg:deb/ubuntu/squidclient?distro=mantic	< 6.1-2ubuntu1.1
pkg:deb/ubuntu/squidclient?distro=lunar	< 5.7-1ubuntu3.1
pkg:deb/ubuntu/squidclient?distro=jammy	< 5.7-0ubuntu0.22.04.2
pkg:deb/ubuntu/squidclient?distro=focal	< 4.10-1ubuntu1.8
pkg:deb/ubuntu/squid?distro=mantic	< 6.1-2ubuntu1.1
pkg:deb/ubuntu/squid?distro=lunar	< 5.7-1ubuntu3.1
pkg:deb/ubuntu/squid?distro=jammy	< 5.7-0ubuntu0.22.04.2
pkg:deb/ubuntu/squid?distro=focal	< 4.10-1ubuntu1.8
pkg:deb/ubuntu/squid-purge?distro=mantic	< 6.1-2ubuntu1.1
pkg:deb/ubuntu/squid-purge?distro=lunar	< 5.7-1ubuntu3.1
pkg:deb/ubuntu/squid-purge?distro=jammy	< 5.7-0ubuntu0.22.04.2
pkg:deb/ubuntu/squid-purge?distro=focal	< 4.10-1ubuntu1.8
pkg:deb/ubuntu/squid-openssl?distro=mantic	< 6.1-2ubuntu1.1
pkg:deb/ubuntu/squid-openssl?distro=lunar	< 5.7-1ubuntu3.1
pkg:deb/ubuntu/squid-openssl?distro=jammy	< 5.7-0ubuntu0.22.04.2
pkg:deb/ubuntu/squid-common?distro=mantic	< 6.1-2ubuntu1.1
pkg:deb/ubuntu/squid-common?distro=lunar	< 5.7-1ubuntu3.1
pkg:deb/ubuntu/squid-common?distro=jammy	< 5.7-0ubuntu0.22.04.2
pkg:deb/ubuntu/squid-common?distro=focal	< 4.10-1ubuntu1.8
pkg:deb/ubuntu/squid-cgi?distro=mantic	< 6.1-2ubuntu1.1
pkg:deb/ubuntu/squid-cgi?distro=lunar	< 5.7-1ubuntu3.1
pkg:deb/ubuntu/squid-cgi?distro=jammy	< 5.7-0ubuntu0.22.04.2
pkg:deb/ubuntu/squid-cgi?distro=focal	< 4.10-1ubuntu1.8

ID

USN-6500-1

Severity

high

Severity from

CVE-2023-46724

URL

https://ubuntu.com/security/notices/USN-6500-1

Published

2023-11-21T15:42:49
(10 months ago)

Modified

2023-11-21T15:42:49
(10 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/squidclient?distro=mantic	ubuntu	squidclient	< 6.1-2ubuntu1.1	mantic
Affected	pkg:deb/ubuntu/squidclient?distro=lunar	ubuntu	squidclient	< 5.7-1ubuntu3.1	lunar
Affected	pkg:deb/ubuntu/squidclient?distro=jammy	ubuntu	squidclient	< 5.7-0ubuntu0.22.04.2	jammy
Affected	pkg:deb/ubuntu/squidclient?distro=focal	ubuntu	squidclient	< 4.10-1ubuntu1.8	focal
Affected	pkg:deb/ubuntu/squid?distro=mantic	ubuntu	squid	< 6.1-2ubuntu1.1	mantic
Affected	pkg:deb/ubuntu/squid?distro=lunar	ubuntu	squid	< 5.7-1ubuntu3.1	lunar
Affected	pkg:deb/ubuntu/squid?distro=jammy	ubuntu	squid	< 5.7-0ubuntu0.22.04.2	jammy
Affected	pkg:deb/ubuntu/squid?distro=focal	ubuntu	squid	< 4.10-1ubuntu1.8	focal
Affected	pkg:deb/ubuntu/squid-purge?distro=mantic	ubuntu	squid-purge	< 6.1-2ubuntu1.1	mantic
Affected	pkg:deb/ubuntu/squid-purge?distro=lunar	ubuntu	squid-purge	< 5.7-1ubuntu3.1	lunar
Affected	pkg:deb/ubuntu/squid-purge?distro=jammy	ubuntu	squid-purge	< 5.7-0ubuntu0.22.04.2	jammy
Affected	pkg:deb/ubuntu/squid-purge?distro=focal	ubuntu	squid-purge	< 4.10-1ubuntu1.8	focal
Affected	pkg:deb/ubuntu/squid-openssl?distro=mantic	ubuntu	squid-openssl	< 6.1-2ubuntu1.1	mantic
Affected	pkg:deb/ubuntu/squid-openssl?distro=lunar	ubuntu	squid-openssl	< 5.7-1ubuntu3.1	lunar
Affected	pkg:deb/ubuntu/squid-openssl?distro=jammy	ubuntu	squid-openssl	< 5.7-0ubuntu0.22.04.2	jammy
Affected	pkg:deb/ubuntu/squid-common?distro=mantic	ubuntu	squid-common	< 6.1-2ubuntu1.1	mantic
Affected	pkg:deb/ubuntu/squid-common?distro=lunar	ubuntu	squid-common	< 5.7-1ubuntu3.1	lunar
Affected	pkg:deb/ubuntu/squid-common?distro=jammy	ubuntu	squid-common	< 5.7-0ubuntu0.22.04.2	jammy
Affected	pkg:deb/ubuntu/squid-common?distro=focal	ubuntu	squid-common	< 4.10-1ubuntu1.8	focal
Affected	pkg:deb/ubuntu/squid-cgi?distro=mantic	ubuntu	squid-cgi	< 6.1-2ubuntu1.1	mantic
Affected	pkg:deb/ubuntu/squid-cgi?distro=lunar	ubuntu	squid-cgi	< 5.7-1ubuntu3.1	lunar
Affected	pkg:deb/ubuntu/squid-cgi?distro=jammy	ubuntu	squid-cgi	< 5.7-0ubuntu0.22.04.2	jammy
Affected	pkg:deb/ubuntu/squid-cgi?distro=focal	ubuntu	squid-cgi	< 4.10-1ubuntu1.8	focal

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date