[USN-6728-3] Squid vulnerability

Severity High
Affected Packages 5
CVEs 2

Squid could be made to crash if it received specially crafted network traffic.

USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused
Squid to crash in certain environments on Ubuntu 20.04 LTS and was disabled
in USN-6728-2. The problematic fix for CVE-2023-5824 has now been corrected
and reinstated in this update.

We apologize for the inconvenience.

Original advisory details:

Joshua Rogers discovered that Squid incorrectly handled collapsed
forwarding. A remote attacker could possibly use this issue to cause Squid
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)

Joshua Rogers discovered that Squid incorrectly handled certain structural
elements. A remote attacker could possibly use this issue to cause Squid to
crash, resulting in a denial of service. (CVE-2023-5824)

Joshua Rogers discovered that Squid incorrectly handled Cache Manager error
responses. A remote trusted client can possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2024-23638)

Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked
decoder. A remote attacker could possibly use this issue to cause Squid to
stop responding, resulting in a denial of service. (CVE-2024-25111)

Joshua Rogers discovered that Squid incorrectly handled HTTP header
parsing. A remote trusted client can possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2024-25617)

ID
USN-6728-3
Severity
high
URL
https://ubuntu.com/security/notices/USN-6728-3
Published
2024-04-23T11:20:04
(4 weeks ago)
Modified
2024-04-23T11:20:04
(4 weeks ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:deb/ubuntu/squidclient?distro=focal ubuntu squidclient < 4.10-1ubuntu1.12 focal
Affected pkg:deb/ubuntu/squid?distro=focal ubuntu squid < 4.10-1ubuntu1.12 focal
Affected pkg:deb/ubuntu/squid-purge?distro=focal ubuntu squid-purge < 4.10-1ubuntu1.12 focal
Affected pkg:deb/ubuntu/squid-common?distro=focal ubuntu squid-common < 4.10-1ubuntu1.12 focal
Affected pkg:deb/ubuntu/squid-cgi?distro=focal ubuntu squid-cgi < 4.10-1ubuntu1.12 focal
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...