Use-After-Free vulnerability in Squid package (CVE-2023-49288)
Summary
CVE-2023-49288: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affects squid across 2 version ranges.
< 6.1-r0
< 20d1c7236c7493b1f8b7e47f2e2afc529232071c
Fixed in 6.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a caching proxy for the Web that supports HTTP, HTTPS, FTP, and more. It is widely used to improve web performance by caching frequently accessed content. The Squid package versions 3.5 up to and including 5.9, when configured with "collapsed_forwarding on", are vulnerable to a Use-After-Free bug. This bug can be exploited to launch a Denial of Service attack through collapsed forwarding. However, configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not affected. The issue has been addressed in Squid version 6.0.1, and users are advised to upgrade. If upgrading is not possible, removing all collapsed_forwarding lines from the squid.conf file is recommended.
Vulnerability Detail
The Use-After-Free vulnerability in Squid arises when a program attempts to access memory that has already been freed. In this case, the vulnerability can be triggered by collapsed forwarding, leading to a Denial of Service attack. Attackers can exploit this vulnerability to crash the Squid proxy, causing service disruption. The vulnerability affects all versions of Squid from 3.5 up to and including 5.9, specifically when configured with "collapsed_forwarding on". Squid versions 6.0.1 and above have addressed this issue and are not vulnerable.
How To Fix
Minimum fixed version
6.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not possible, users can apply the following workaround by removing all collapsed_forwarding lines from the squid.conf file:
- Open the squid.conf file in a text editor.
- Search for the "collapsed_forwarding" directive.
- Remove all lines that contain this directive.
- Save the changes and restart the Squid service.
Please note that this workaround may impact the functionality of collapsed forwarding, but it will mitigate the risk of the Use-After-Free vulnerability.
Conclusion
The Use-After-Free vulnerability in the Squid package (CVE-2023-49288) can lead to a Denial of Service attack through collapsed forwarding. It affects Squid versions 3.5 up to and including 5.9 when configured with "collapsed_forwarding on". Upgrading to Squid version 6.0.1 or later is the recommended solution. If upgrading is not feasible, removing all collapsed_forwarding lines from the squid.conf file will mitigate the risk. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for squid →
FAQ
Squid is a caching proxy for the Web that supports HTTP, HTTPS, FTP, and more. It is commonly used to improve web performance by caching frequently accessed content.
All versions of Squid from 3.5 up to and including 5.9 are affected when configured with "collapsed_forwarding on". Squid versions 6.0.1 and above have addressed this vulnerability.
A Use-After-Free vulnerability occurs when a program attempts to access memory that has already been freed. In this case, the vulnerability can be triggered by collapsed forwarding in Squid, leading to a Denial of Service attack.
To fix this vulnerability, it is recommended to upgrade to Squid version 6.0.1 or later. Alternatively, you can remove all collapsed_forwarding lines from the squid.conf configuration file.
Yes, if upgrading is not possible, you can remove all collapsed_forwarding lines from the squid.conf file. However, this may impact the functionality of collapsed forwarding.
Related vulnerabilities
Recent vulnerabilities recorded for squid.
