CVE-2016-2390: Input Validation
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2390?
CVE-2016-2390 is rated as a medium severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2016-2390?
To fix CVE-2016-2390, upgrade Squid to version 3.5.14 or later, and 4.0.6 or later.
What software versions are affected by CVE-2016-2390?
CVE-2016-2390 affects Squid versions up to and including 3.5.13, as well as the specific versions 4.0.4 and 4.0.5.
What type of attack is possible with CVE-2016-2390?
CVE-2016-2390 allows remote attackers to cause an application crash through improper handling of SSL handshake errors.
What component of Squid is impacted by CVE-2016-2390?
CVE-2016-2390 impacts the FwdState::connectedToPeer method in the FwdState.cc file of Squid.