Important: squid:4 security update
Summary
ALSA-2022:5526: Important: squid:4 security update. Affects libecap versions < 1.0.1-2.module_el8.6.0+2741+01592ae8. Fixed in 1.0.1-2.module_el8.6.0+2741+01592ae8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It is widely used to improve web server performance by caching frequently accessed content. The squid package is an integral part of the AlmaLinux:8 ecosystem.
Vulnerability Detail
The vulnerability (CVE-2021-46784) in squid allows for a denial-of-service (DoS) attack when processing gopher server responses. An attacker can exploit this vulnerability to send specially crafted responses that cause the squid server to consume excessive resources, leading to a DoS condition. The impact of this vulnerability can range from degraded performance to complete unavailability of the squid server.
How To Fix
Minimum fixed version
1.0.1-2.module_el8.6.0+2741+01592ae8
This is the first release that contains the fix.
sudo dnf update libecapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to protect the squid server from potential attacks.
Conclusion
In conclusion, the squid package in the AlmaLinux:8 ecosystem is vulnerable to a denial-of-service (DoS) attack. It is crucial to update the squid package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libecap →
FAQ
Squid is a high-performance proxy caching server that improves web server performance by caching frequently accessed content.
The vulnerability allows for a denial-of-service (DoS) attack, which can result in degraded performance or complete unavailability of the squid server.
To fix this vulnerability, update the squid package to version 7:4.15-3.module_el8.6.0+3010+383bc947.1 or later.
No, there is no known workaround for this vulnerability. Applying the security update is the recommended solution.
The security update can be obtained from the AlmaLinux package repository.
Related vulnerabilities
Recent vulnerabilities recorded for libecap.
