Denial of Service Vulnerability in Squid Package: CVE-2020-24606
Summary
ALPINE-CVE-2020-24606: Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. Affects squid versions < 4.13-r0. Fixed in 4.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Squid is a widely-used caching proxy for the web that supports HTTP, HTTPS, FTP, and more. It is designed to improve web performance by caching frequently requested content, reducing bandwidth usage, and enhancing response times. However, Squid has a vulnerability identified as CVE-2020-24606, which affects versions prior to 4.13 and 5.x before 5.0.4. This vulnerability allows a trusted peer to exploit the cache digests feature, leading to potential Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from a flaw in the peerDigestHandleReply() function within the peer_digest.cc file, which mishandles EOF (End of File) conditions. When cache_peer is used with the cache digests feature, a crafted Cache Digest response message can cause the Squid process to enter a livelock state, consuming all available CPU cycles. This can lead to service unavailability, as legitimate requests cannot be processed due to the overwhelming resource consumption.
How To Fix
Minimum fixed version
4.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the cache digests feature in your Squid configuration. This can be done by commenting out or removing the 'cache_digest' directive in the squid.conf file. However, this may impact the performance benefits provided by cache digests.
Conclusion
CVE-2020-24606 represents a significant vulnerability in the Squid caching proxy, allowing for Denial of Service attacks through crafted Cache Digest responses. Updating to the patched version is crucial to maintaining service availability and security.
See every vulnerability recorded for squid →
FAQ
CVE-2020-24606 is a vulnerability in the Squid caching proxy that allows a trusted peer to cause a Denial of Service by consuming all available CPU cycles.
Squid versions prior to 4.13 and 5.x before 5.0.4 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of CVE-2020-24606 is 7.5, indicating a high severity level.
If you cannot update Squid right away, consider disabling the cache digests feature as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
