Description
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High
Affected products
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux_eus9.2 – 9.2
- RedHat / enterprise_linux_eus8.6 – 8.6
- RedHat / enterprise_linux_eus8.8 – 8.8
- RedHat / enterprise_linux_eus9.0 – 9.0
- RedHat / enterprise_linux_for_arm_648.0_aarch64 – 8.0_aarch64
- RedHat / enterprise_linux_for_ibm_z_systems8.0_s390x – 8.0_s390x
- RedHat / enterprise_linux_for_power_little_endian8.0_ppc64le – 8.0_ppc64le
- RedHat / enterprise_linux_server7.0 – 7.0
- RedHat / enterprise_linux_server_aus8.6 – 8.6
- RedHat / enterprise_linux_server_aus8.2 – 8.2
- RedHat / enterprise_linux_server_aus8.4 – 8.4
- RedHat / enterprise_linux_server_aus9.2 – 9.2
- RedHat / enterprise_linux_server_tus8.8 – 8.8
- RedHat / enterprise_linux_server_tus8.2 – 8.2
- RedHat / enterprise_linux_server_tus8.4 – 8.4
- RedHat / enterprise_linux_server_tus8.6 – 8.6
- RedHat / enterprise_linux_server_tus9.2 – 9.2
- RedHat / enterprise_linux_workstation7.0 – 7.0
- squid-cache / squid3.2.0.1 – 6.4
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6266
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6267
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6268
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6748
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6801
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6803
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6804
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6805
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6810
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6882
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:6884
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:7213
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:7576
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:7578
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2023-46847
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2245916
- VENDOR_ADVISORYhttps://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g
Updated 19m ago · 8 sources