CVE-2022-41317: Medium severity Squid-Cache Squid vulnerability

Q: What is the vulnerability ID for this issue in Squid?

The vulnerability ID for this issue in Squid is CVE-2022-41317.

Q: What is the severity of CVE-2022-41317?

The severity of CVE-2022-41317 is medium with a CVSS score of 6.5.

Q: What is the affected software for CVE-2022-41317?

The affected software for CVE-2022-41317 is Squid versions 4.9 through 4.17 and 5.0.6 through 5.6.

Q: How can I fix CVE-2022-41317?

To fix CVE-2022-41317, update your Squid installation to version 5.7 or higher.

Q: Where can I find more information about CVE-2022-41317?

You can find more information about CVE-2022-41317 on the Squid-cache website and the GitHub Security Advisory.

Published Dec 25, 2022

Updated

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.

Affected Software

12 affected componentsFixes available

Squid-Cache Squid>=4.9<=4.17

Squid-Cache Squid>=5.0.6<5.7

alpine/squid>=4.9<5.7-r0

5.7-r0

alpine/squid>=4.9<5.7-r0

5.7-r0

alpine/squid>=4.9<5.7-r0

5.7-r0

alpine/squid>=4.9<5.7-r0

5.7-r0

alpine/squid>=4.9<5.7-r0

5.7-r0

alpine/squid>=4.9<5.7-r0

5.7-r0

debian/squid<5.7-1

5.7-1

debian/squid<5.7-1

5.7-1

debian/squid<5.7-1

5.7-1

debian/squid

5.7-2+deb12u55.7-2+deb12u66.13-2+deb13u36.13-2+deb13u47.8-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/squid to a version that resolves this vulnerability.
Fixed in 5.7-r0
Upgrade
Upgrade debian/squid to a version that resolves this vulnerability.
Fixed in 5.7-1
Upgrade
Upgrade debian/squid to a version that resolves this vulnerability.
Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u6Fixed in 6.13-2+deb13u3Fixed in 6.13-2+deb13u4Fixed in 7.8-1
Upgrade
Upgrade Squid to a version that resolves this vulnerability.
Fixed in 5.7

Event History

Dec 25, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·07:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5258

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3151-1

Frequently Asked Questions

What is the vulnerability ID for this issue in Squid?

The vulnerability ID for this issue in Squid is CVE-2022-41317.

What is the severity of CVE-2022-41317?

The severity of CVE-2022-41317 is medium with a CVSS score of 6.5.

What is the affected software for CVE-2022-41317?

The affected software for CVE-2022-41317 is Squid versions 4.9 through 4.17 and 5.0.6 through 5.6.

How can I fix CVE-2022-41317?

To fix CVE-2022-41317, update your Squid installation to version 5.7 or higher.

Where can I find more information about CVE-2022-41317?

You can find more information about CVE-2022-41317 on the Squid-cache website and the GitHub Security Advisory.

CVE-2022-41317: Medium severity Squid-Cache Squid vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the vulnerability ID for this issue in Squid?

What is the severity of CVE-2022-41317?

What is the affected software for CVE-2022-41317?

How can I fix CVE-2022-41317?

Where can I find more information about CVE-2022-41317?

Company

Resources

Contact