CVE-2021-46784: Medium severity Squid-Cache Squid vulnerability
A vulnerability was found in squid. Due to improper buffer management Squid is vulnerable to a Denial of Service attack when processing Gopher server responses.
The issue is fixed upstream in 5.6.
References: https://github.com/squid-cache/squid/security/advisories/GHSA-f5cp-6rh3-284w
Other sources
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 4.13-10+deb11u3Fixed in 4.13-10+deb11u6Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u4Fixed in 6.13-2+deb13u1Fixed in 7.4-1 - Upgrade
Upgrade
redhat/squidto a version that resolves this vulnerability.Fixed in 5.6 - Upgrade
Upgrade
squidto a version that resolves this vulnerability.Fixed in 5.6
Event History
Frequently Asked Questions
What is the vulnerability ID of this Squid vulnerability?
The vulnerability ID is CVE-2021-46784.
What is the severity level of CVE-2021-46784?
The severity level of CVE-2021-46784 is medium (6.5).
What is affected by CVE-2021-46784?
Squid versions 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6 are affected by CVE-2021-46784.
What is the impact of CVE-2021-46784?
CVE-2021-46784 can cause a Denial of Service (DoS) when processing long Gopher server responses.
How can I fix CVE-2021-46784?
To fix CVE-2021-46784, it is recommended to update to Squid versions 4.6-1+deb10u7, 4.6-1+deb10u8, 4.13-10+deb11u2, or 5.7-2 (or later).