Security Update for squid3
Summary
DSA-3327-1: squid3 - security update. Affects squid3 versions < 3.1.20-2.2+deb7u3. Fixed in 3.1.20-2.2+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid3 is a fully-featured web proxy cache that allows clients to access web content through a gateway proxy. It is widely used to improve web performance and provide caching capabilities. However, a vulnerability has been discovered in Squid3 when configured with cache_peer and operating on explicit proxy traffic. This vulnerability could allow remote clients to gain unrestricted access through a gateway proxy to its backend proxy.
Vulnerability Detail
The vulnerability in Squid3 arises from its incorrect handling of CONNECT method peer responses. When configured with cache_peer and operating on explicit proxy traffic, remote clients can exploit this flaw to bypass restrictions and gain unrestricted access to the backend proxy. This could potentially lead to unauthorized access to sensitive information or abuse of the proxy infrastructure.
How To Fix
Minimum fixed version
3.1.20-2.2+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade squid3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Conclusion
It is crucial to promptly upgrade your squid3 packages to the fixed versions to mitigate the risk of unauthorized access and abuse of the proxy infrastructure. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for squid3 →
FAQ
Squid3 is a fully-featured web proxy cache that improves web performance and provides caching capabilities.
The vulnerability allows remote clients to bypass restrictions and gain unrestricted access to the backend proxy, potentially leading to unauthorized access or abuse of the proxy infrastructure.
To fix this vulnerability, upgrade your squid3 packages to the fixed versions mentioned in the advisory.
No specific workarounds are mentioned. Upgrading to the fixed versions is the recommended solution.
You can obtain the updated packages from the official Debian repositories or through package management tools like apt-get.
Related vulnerabilities
Recent vulnerabilities recorded for squid3.
