Denial of Service Vulnerability in Squid Package
Summary
ALPINE-CVE-2021-28662: An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. Affects squid versions < 4.15-r0. Fixed in 4.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching proxy for the web that supports HTTP, HTTPS, and FTP protocols. It is designed to improve web performance by caching frequently requested content and reducing bandwidth usage. Squid is known for its flexibility and extensive configuration options, making it a popular choice for organizations looking to optimize their web traffic. However, certain versions of Squid are vulnerable to a denial of service (DoS) attack, which can disrupt its functionality and impact users relying on its services.
Vulnerability Detail
An issue was discovered in Squid versions 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a specific response header over HTTP or HTTPS, it can lead to a denial of service. This vulnerability can be exploited through benign network traffic, making it difficult to detect and mitigate. The potential ramifications include service interruptions and degraded performance for users relying on the Squid proxy.
How To Fix
Minimum fixed version
4.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure Squid to ignore specific response headers that may trigger the vulnerability. This can be done by modifying the Squid configuration file (usually located at /etc/squid/squid.conf) to filter out problematic headers. However, this is not a permanent solution and should be followed up with an update.
Conclusion
The vulnerability in Squid presents a significant risk of denial of service, affecting multiple versions of the package. It is crucial for users to update to the patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for squid →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Squid versions 4.x before 4.15 and 5.x before 5.0.6 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by using the Vulert playground without any signup.
The vulnerability can lead to denial of service, causing interruptions and degraded performance for users relying on the Squid proxy.
Yes, the permanent fix is to update to the patched versions of Squid: 4.15-r0 for 4.x or 5.0.6-r0 for 5.x.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
