[USN-6728-3] Squid vulnerability

Severity High

Affected Packages 5

CVEs 2

Squid could be made to crash if it received specially crafted network traffic.

USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused
Squid to crash in certain environments on Ubuntu 20.04 LTS and was disabled
in USN-6728-2. The problematic fix for CVE-2023-5824 has now been corrected
and reinstated in this update.

We apologize for the inconvenience.

Original advisory details:

Joshua Rogers discovered that Squid incorrectly handled collapsed
forwarding. A remote attacker could possibly use this issue to cause Squid
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)

Joshua Rogers discovered that Squid incorrectly handled certain structural
elements. A remote attacker could possibly use this issue to cause Squid to
crash, resulting in a denial of service. (CVE-2023-5824)

Joshua Rogers discovered that Squid incorrectly handled Cache Manager error
responses. A remote trusted client can possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2024-23638)

Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked
decoder. A remote attacker could possibly use this issue to cause Squid to
stop responding, resulting in a denial of service. (CVE-2024-25111)

Joshua Rogers discovered that Squid incorrectly handled HTTP header
parsing. A remote trusted client can possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2024-25617)

Package	Affected Version
pkg:deb/ubuntu/squidclient?distro=focal	< 4.10-1ubuntu1.12
pkg:deb/ubuntu/squid?distro=focal	< 4.10-1ubuntu1.12
pkg:deb/ubuntu/squid-purge?distro=focal	< 4.10-1ubuntu1.12
pkg:deb/ubuntu/squid-common?distro=focal	< 4.10-1ubuntu1.12
pkg:deb/ubuntu/squid-cgi?distro=focal	< 4.10-1ubuntu1.12

ID

USN-6728-3

Severity

high

Severity from

CVE-2023-49288

URL

https://ubuntu.com/security/notices/USN-6728-3

Published

2024-04-23T11:20:04
(7 months ago)

Modified

2024-04-23T11:20:04
(7 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/squidclient?distro=focal	ubuntu	squidclient	< 4.10-1ubuntu1.12	focal
Affected	pkg:deb/ubuntu/squid?distro=focal	ubuntu	squid	< 4.10-1ubuntu1.12	focal
Affected	pkg:deb/ubuntu/squid-purge?distro=focal	ubuntu	squid-purge	< 4.10-1ubuntu1.12	focal
Affected	pkg:deb/ubuntu/squid-common?distro=focal	ubuntu	squid-common	< 4.10-1ubuntu1.12	focal
Affected	pkg:deb/ubuntu/squid-cgi?distro=focal	ubuntu	squid-cgi	< 4.10-1ubuntu1.12	focal

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date