Denial of Service vulnerability in Squid package
Summary
CVE-2023-46848: Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input. Affects squid across 2 version ranges.
< 6.4-r0
>= f4cfdb7a62168bef09f8cfa438c2a730206c82ed, < 1d8175b27fc1c347649d4f221ff2633e8d800429
Fixed in 6.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching proxy server that provides support for HTTP, HTTPS, FTP, and other protocols. It is designed to improve web performance by caching frequently accessed content. However, the Squid package is vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability (CVE-2023-46848) in Squid allows a remote attacker to perform a DoS attack by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input. This can lead to the server becoming unresponsive or crashing, resulting in a denial of service for legitimate users.
How To Fix
Minimum fixed version
6.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Squid package to the fixed version to mitigate the risk of a DoS attack.
Conclusion
The Denial of Service vulnerability in the Squid package can be exploited by remote attackers to cause a DoS attack. It is crucial to update the Squid package to the fixed version to protect against this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for squid →
FAQ
Squid is a caching proxy server that improves web performance by caching frequently accessed content.
A DoS attack is an attempt to make a computer or network resource unavailable to its intended users, typically by overwhelming the target with a flood of internet traffic.
The vulnerability allows a remote attacker to perform a DoS attack, causing the Squid server to become unresponsive or crash, resulting in a denial of service for legitimate users.
Yes, updating the Squid package to version 6.4-r0 or later fixes the vulnerability. It is recommended to update the package as soon as possible.
No, there are no known workarounds for this vulnerability. Updating the Squid package is the only way to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for squid.
