CVE-2021-28652: Medium severity squid web proxy cache vulnerability
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.
Other sources
Due to an incorrect parser validation bug Squid is vulnerable to a Denial of Service attack against the Cache Manager API. This problem allows a trusted client to trigger memory leaks which over time lead to a Denial of Service against Squid and the machine it is operating on. This attack is limited to clients with Cache Manager API access privilege.
Upstream security advisory: https://github.com/squid-cache/squid/security/advisories/GHSA-m47m-9hvw-7447
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in Squid?
The vulnerability ID for this issue in Squid is CVE-2021-28652.
What is the severity of CVE-2021-28652?
The severity of CVE-2021-28652 is high.
How does CVE-2021-28652 impact Squid?
CVE-2021-28652 allows a trusted client to trigger memory leaks that over time lead to a Denial of Service attack against the Cache Manager API.
Which versions of Squid are affected by CVE-2021-28652?
Versions before 4.15 and 5.x before 5.0.6 of Squid are affected by CVE-2021-28652.
How can I fix the vulnerability in Squid?
To fix the vulnerability in Squid, update to version 4.15 or 5.0.6 or later.