CVE-2020-8517: Input Validation
An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in extlmgroupacl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 4.13-10+deb11u3Fixed in 4.13-10+deb11u6Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u4Fixed in 6.13-2+deb13u2Fixed in 7.6-2 - Upgrade
Upgrade
Squidto a version that resolves this vulnerability.Fixed in 4.10
Event History
Frequently Asked Questions
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2020-8517.
What is the severity of CVE-2020-8517?
The severity of CVE-2020-8517 is high with a score of 7.5.
Which software versions are affected by CVE-2020-8517?
Versions of Squid before 4.10 are affected by CVE-2020-8517.
How can I fix CVE-2020-8517?
To fix CVE-2020-8517, update Squid to version 4.10 or later.
Where can I find more information about CVE-2020-8517?
You can find more information about CVE-2020-8517 at the following references: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html), [Reference 2](http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html), [Reference 3](http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html).