This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Squid version 6.5 fixes 3 high-severity vulnerabilities
Squid version 6.5 fixes 3 high-severity vulnerabilities that require no authentication and allow a DoS attack.
A remote unauthenticated attacker can carry out a DoS attack by sending specially crafted HTTP messages [1]. Impact: Denial of service Recommendation: The vulnerability is fixed in version 6.5.
The vulnerability is present in product:
- Squid; >=2.2, <=5.9; >=6.0, <=6.4
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2023-49285 at cve.org, NVD
- CWE-41 at cwe.mitre.org
The vulnerability was publicly disclosed 2. 12. 2023. This report was last updated 6. 12. 2023.
A remote unauthenticated attacker can carry out a DoS attack when the proxy server is under load [2]. Impact: Denial of service Recommendation: The vulnerability is fixed in version 6.5.
The vulnerability is present in product:
- Squid; <6.5
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
The vulnerability was publicly disclosed 2. 12. 2023. This report was last updated 6. 12. 2023.
A remote unauthenticated attacker can carry out a DoS attack on a proxy server with the "collapsed forwarding" feature configured [3][4]. Impact: Denial of service
The vulnerability is present in product:
- Squid; >=3.5, <=5.9
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2023-49288 at cve.org, NVD
- CWE-15 at cwe.mitre.org
- CWE-41 at cwe.mitre.org
The vulnerability was publicly disclosed 2. 12. 2023. This report was last updated 6. 12. 2023.
Links
- [1] https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9
- [2] https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27
- [3] https://github.com/squid-cache/squid/security/advisories/GHSA-rj5h-46j6-q2g5
- [4] https://wiki.squid-cache.org/Features/CollapsedForwarding
By CESNET, z.s.p.o. Michaela Jarošová on 6. 12. 2023.