Vulnerability in Privoxy: CVE-2021-44540
Summary
CVE-2021-44540: A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing. Affects privoxy versions < 3.0.33-r0. Fixed in 3.0.33-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Privoxy is an open-source web proxy with advanced filtering capabilities. It is designed to protect privacy, modify web page data, manage cookies, and more. The vulnerability identified as CVE-2021-44540 affects Privoxy versions 0 to 3.0.33-r0 in the Alpine Linux ecosystem.
Vulnerability Detail
The vulnerability in Privoxy, fixed in get_url_spec_param(), allows an attacker to exploit a memory leak issue. Specifically, the compiled pattern spec memory is not freed before bailing, leading to potential memory corruption or denial of service. An attacker could potentially craft a malicious request to trigger this vulnerability and compromise the integrity or availability of the Privoxy service.
How To Fix
Minimum fixed version
3.0.33-r0
This is the first release that contains the fix.
sudo apk add --upgrade privoxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating Privoxy to the patched version.
Conclusion
The vulnerability in Privoxy (CVE-2021-44540) poses a risk of memory corruption or denial of service. It is crucial to update Privoxy to the patched version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for privoxy →
FAQ
Privoxy is an open-source web proxy that provides advanced filtering capabilities for privacy protection, web page modification, cookie management, and more.
This vulnerability could potentially lead to memory corruption or denial of service in Privoxy, compromising its integrity or availability.
To fix this vulnerability, update Privoxy to version 3.0.33-r0 or later, which includes the necessary patch.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
For more information about this vulnerability, you can refer to the CVE-2021-44540 entry in the National Vulnerability Database (NVD) or the provided database-specific source link.
Related vulnerabilities
Recent vulnerabilities recorded for privoxy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
