CVE-2016-10003: Infoleak
First published: Fri Jan 27 2017(Updated: )
Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Squid Web Proxy Cache | >=3.5.0.1<3.5.23 | |
| Squid Web Proxy Cache | >=4.0.1<4.0.17 | |
| Squid Web Proxy Cache | =3.5.0.1 | |
| Squid Web Proxy Cache | =3.5.0.2 | |
| Squid Web Proxy Cache | =3.5.0.3 | |
| Squid Web Proxy Cache | =3.5.0.4 | |
| Squid Web Proxy Cache | =3.5.1 | |
| Squid Web Proxy Cache | =3.5.2 | |
| Squid Web Proxy Cache | =3.5.3 | |
| Squid Web Proxy Cache | =3.5.4 | |
| Squid Web Proxy Cache | =3.5.5 | |
| Squid Web Proxy Cache | =3.5.6 | |
| Squid Web Proxy Cache | =3.5.7 | |
| Squid Web Proxy Cache | =3.5.8 | |
| Squid Web Proxy Cache | =3.5.9 | |
| Squid Web Proxy Cache | =3.5.10 | |
| Squid Web Proxy Cache | =3.5.11 | |
| Squid Web Proxy Cache | =3.5.12 | |
| Squid Web Proxy Cache | =3.5.13 | |
| Squid Web Proxy Cache | =3.5.14 | |
| Squid Web Proxy Cache | =3.5.15 | |
| Squid Web Proxy Cache | =3.5.16 | |
| Squid Web Proxy Cache | =3.5.17 | |
| Squid Web Proxy Cache | =3.5.18 | |
| Squid Web Proxy Cache | =3.5.19 | |
| Squid Web Proxy Cache | =3.5.20 | |
| Squid Web Proxy Cache | =3.5.21 | |
| Squid Web Proxy Cache | =3.5.22 | |
| Squid Web Proxy Cache | =4.0.1 | |
| Squid Web Proxy Cache | =4.0.2 | |
| Squid Web Proxy Cache | =4.0.3 | |
| Squid Web Proxy Cache | =4.0.4 | |
| Squid Web Proxy Cache | =4.0.5 | |
| Squid Web Proxy Cache | =4.0.6 | |
| Squid Web Proxy Cache | =4.0.7 | |
| Squid Web Proxy Cache | =4.0.8 | |
| Squid Web Proxy Cache | =4.0.9 | |
| Squid Web Proxy Cache | =4.0.10 | |
| Squid Web Proxy Cache | =4.0.11 | |
| Squid Web Proxy Cache | =4.0.12 | |
| Squid Web Proxy Cache | =4.0.13 | |
| Squid Web Proxy Cache | =4.0.14 | |
| Squid Web Proxy Cache | =4.0.15 | |
| Squid Web Proxy Cache | =4.0.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-10003?
CVE-2016-10003 is classified as a moderate severity vulnerability due to its potential impact on data privacy.
How do I fix CVE-2016-10003?
To fix CVE-2016-10003, upgrade Squid HTTP Proxy to version 3.5.23 or newer, or 4.0.17 or newer.
What software versions are affected by CVE-2016-10003?
CVE-2016-10003 affects Squid HTTP Proxy versions from 3.5.0.1 to 3.5.22 and 4.0.1 to 4.0.16.
Is CVE-2016-10003 easy to exploit?
Exploitation of CVE-2016-10003 may require a specific configuration, but could lead to unintended data exposure.
What are the implications of CVE-2016-10003?
CVE-2016-10003 can result in private responses being delivered to multiple clients, compromising confidentiality.
- agent/references
- agent/type
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/squid-cache
- canonical/squid web proxy cache
- version/squid web proxy cache/3.5.0.1
- version/squid web proxy cache/4.0.1
- version/squid web proxy cache/3.5.0.2
- version/squid web proxy cache/3.5.0.3
- version/squid web proxy cache/3.5.0.4
- version/squid web proxy cache/3.5.1
- version/squid web proxy cache/3.5.2
- version/squid web proxy cache/3.5.3
- version/squid web proxy cache/3.5.4
- version/squid web proxy cache/3.5.5
- version/squid web proxy cache/3.5.6
- version/squid web proxy cache/3.5.7
- version/squid web proxy cache/3.5.8
- version/squid web proxy cache/3.5.9
- version/squid web proxy cache/3.5.10
- version/squid web proxy cache/3.5.11
- version/squid web proxy cache/3.5.12
- version/squid web proxy cache/3.5.13
- version/squid web proxy cache/3.5.14
- version/squid web proxy cache/3.5.15
- version/squid web proxy cache/3.5.16
- version/squid web proxy cache/3.5.17
- version/squid web proxy cache/3.5.18
- version/squid web proxy cache/3.5.19
- version/squid web proxy cache/3.5.20
- version/squid web proxy cache/3.5.21
- version/squid web proxy cache/3.5.22
- version/squid web proxy cache/4.0.2
- version/squid web proxy cache/4.0.3
- version/squid web proxy cache/4.0.4
- version/squid web proxy cache/4.0.5
- version/squid web proxy cache/4.0.6
- version/squid web proxy cache/4.0.7
- version/squid web proxy cache/4.0.8
- version/squid web proxy cache/4.0.9
- version/squid web proxy cache/4.0.10
- version/squid web proxy cache/4.0.11
- version/squid web proxy cache/4.0.12
- version/squid web proxy cache/4.0.13
- version/squid web proxy cache/4.0.14
- version/squid web proxy cache/4.0.15
- version/squid web proxy cache/4.0.16