CVE-2018-1172: Null Pointer Dereference

Published May 16, 2018

Updated

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Affected Software

1 affected component

Squid-Cache Squid=3.5.27

Event History

May 16, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-1172?

The severity of CVE-2018-1172 is medium with a CVSS score of 5.9.

What software is affected by CVE-2018-1172?

The Squid Software Foundation Squid version 3.5.27 is affected by CVE-2018-1172.

What is the vulnerability description of CVE-2018-1172?

CVE-2018-1172 is a vulnerability that allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318.

Is authentication required to exploit CVE-2018-1172?

No, authentication is not required to exploit CVE-2018-1172.

How can I fix CVE-2018-1172?

To fix CVE-2018-1172, it is recommended to update to a patched version of The Squid Software Foundation Squid.