Critical: squid security update
Summary
ALSA-2023:6748: Critical: squid security update. Affects squid versions < 7:5.5-6.el9_3.1. Fixed in 7:5.5-6.el9_3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It is widely used to improve web server performance by caching frequently accessed content. Squid is an open-source project that has been actively maintained and developed for many years.
Vulnerability Detail
This security update addresses three vulnerabilities in Squid:
-
CVE-2023-46847: Denial of Service in HTTP Digest Authentication This vulnerability could allow an attacker to cause a denial of service by sending specially crafted HTTP requests that trigger a crash in the Squid server.
-
CVE-2023-46846: Request/Response smuggling in HTTP/1.1 and ICAP This vulnerability could allow an attacker to manipulate HTTP requests and responses, potentially leading to unauthorized access or information disclosure.
-
CVE-2023-46848: Denial of Service in FTP This vulnerability could allow an attacker to cause a denial of service by sending specially crafted FTP requests that trigger a crash in the Squid server.
How To Fix
Minimum fixed version
7:5.5-6.el9_3.1
This is the first release that contains the fix.
sudo dnf update squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, this security update addresses critical vulnerabilities in Squid that could lead to denial of service, request/response smuggling, and potential unauthorized access or information disclosure. It is highly recommended to update Squid to the latest version to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for squid →
FAQ
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It is widely used to improve web server performance by caching frequently accessed content.
CVE-2023-46847 could allow an attacker to cause a denial of service by sending specially crafted HTTP requests that trigger a crash in the Squid server.
CVE-2023-46846 could allow an attacker to manipulate HTTP requests and responses, potentially leading to unauthorized access or information disclosure.
CVE-2023-46848 could allow an attacker to cause a denial of service by sending specially crafted FTP requests that trigger a crash in the Squid server.
To update Squid to the fixed version, you can obtain the latest version from the official Squid website or through your distribution's package manager.
Related vulnerabilities
Recent vulnerabilities recorded for squid.
