← Back to CVEs

CVE-2023-49285

HIGH

8.6

Description

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE Details

CVSS v3.1 Score8.6

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/4/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

squid-cache:squid

Weaknesses (CWE)

CWE-126CWE-125

References

http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patch(security-advisories@github.com)

http://www.squid-cache.org/Versions/v6/SQUID-2023_7.patch(security-advisories@github.com)

https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521b(security-advisories@github.com)

https://github.com/squid-cache/squid/commit/deee944f9a12c9fd399ce52f3e2526bb573a9470(security-advisories@github.com)

https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9(security-advisories@github.com)

https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/(security-advisories@github.com)

https://security.netapp.com/advisory/ntap-20240119-0004/(security-advisories@github.com)

http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patch(af854a3a-2127-422b-91ae-364da2661108)

http://www.squid-cache.org/Versions/v6/SQUID-2023_7.patch(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521b(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/squid-cache/squid/commit/deee944f9a12c9fd399ce52f3e2526bb573a9470(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20240119-0004/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.