Moderate: squid:4 security and bug fix update
Summary
ALSA-2022:1939: Moderate: squid:4 security and bug fix update. Affects libecap versions < 1.0.1-2.module_el8.6.0+2741+01592ae8. Fixed in 1.0.1-2.module_el8.6.0+2741+01592ae8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It is widely used to improve web server performance by caching frequently accessed content. Squid is an open-source project with a large community of contributors.
Vulnerability Detail
The vulnerability (CVE-2021-28116) in Squid version 4 allows an out-of-bounds read in the WCCP protocol data, which may lead to information disclosure. An attacker could exploit this vulnerability to access sensitive information or potentially execute arbitrary code. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
1.0.1-2.module_el8.6.0+2741+01592ae8
This is the first release that contains the fix.
sudo dnf update libecapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the Squid version 4 vulnerability (CVE-2021-28116) allows for potential information disclosure and arbitrary code execution. It is recommended to update the affected packages to the fixed versions mentioned in the advisory. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libecap →
FAQ
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
The vulnerability (CVE-2021-28116) may lead to information disclosure and potential execution of arbitrary code.
To fix this vulnerability, update the affected packages to the fixed versions mentioned in the 'how_to_fix' section.
No specific workaround has been mentioned for this vulnerability.
You can find more information about this vulnerability in the CVE page(s) listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libecap.
