Trust Misclassification Vulnerability in Squid Package
Summary
DEBIAN-CVE-2021-41611: An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. Affects squid versions < 5.2-1. Fixed in 5.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching and forwarding HTTP web proxy that supports various protocols, including HTTP, HTTPS, and FTP. It is designed to improve web performance by caching frequently requested content and reducing bandwidth usage. Squid is utilized in numerous environments, from small networks to large enterprise systems. However, certain versions of Squid have been found to have a vulnerability that affects its ability to validate certificates from origin servers or peers, potentially leading to security risks.
Vulnerability Detail
An issue was discovered in Squid versions 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This misclassification allows a remote server to gain improper security trust, which can be exploited to access unsafe or hijacked services. The vulnerability arises from flaws in the certificate validation logic, which can lead to unauthorized access and compromise the integrity of the data being transmitted.
How To Fix
Minimum fixed version
5.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Squid proxy by implementing stricter access control lists (ACLs) to minimize exposure to potentially malicious servers. However, this is not a permanent solution and updating the package is highly recommended.
Conclusion
The vulnerability in Squid poses significant risks by allowing improper trust in certificates, which can lead to unauthorized access to services. It is crucial to update to the patched version 5.2-1 to mitigate these risks. Utilizing tools like Vulert can further enhance your security posture by monitoring for vulnerabilities in your software.
See every vulnerability recorded for squid →
FAQ
Squid versions 5.0.6 through 5.1.x before 5.2 are affected by this vulnerability.
The vulnerability may allow remote servers to gain improper security trust, leading to unauthorized access to unsafe or hijacked services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
You can implement stricter access control lists (ACLs) to limit exposure to potentially malicious servers as a temporary measure.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json, helping you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
