CVE-2021-41611
First published: Mon Oct 18 2021(Updated: )
An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Squid-Cache Squid | >=5.0.6<5.2 | |
| Fedoraproject Fedora | =35 | |
| >=5.0.6<5.2 | ||
| =35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/12/23/2
- http://www.squid-cache.org/Versions/v6/changesets/squid-6-43d6b5c81b88ec2256b430c69a872a1e4f324e4a.patch
- https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWQ2WKDWTSO47S3F6XJJ6HGG2ULWEAE4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CWQ2WKDWTSO47S3F6XJJ6HGG2ULWEAE4/
Frequently Asked Questions
What is CVE-2021-41611?
CVE-2021-41611 is a vulnerability discovered in Squid 5.0.6 through 5.1.x before 5.2 that allows a remote server to obtain security trust improperly.
What is the severity of CVE-2021-41611?
The severity of CVE-2021-41611 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2021-41611?
Squid 5.0.6 through 5.1.x before 5.2 and Fedora 35 are affected by CVE-2021-41611.
How can a remote server exploit CVE-2021-41611?
A remote server can exploit CVE-2021-41611 by incorrectly classifying certain certificates as trusted, allowing it to obtain security trust improperly.
Where can I find more information about CVE-2021-41611?
More information about CVE-2021-41611 can be found at the following references: [Reference 1](http://www.openwall.com/lists/oss-security/2021/12/23/2), [Reference 2](http://www.squid-cache.org/Versions/v6/changesets/squid-6-43d6b5c81b88ec2256b430c69a872a1e4f324e4a.patch), [Reference 3](https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/remedy
- agent/severity
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/squid-cache
- canonical/squid-cache squid
- version/squid-cache squid/5.0.6
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35