CVE-2023-46724: SQUID-2023:4 Denial of Service in SSL Certificate validation
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-46724?
CVE-2023-46724 is a vulnerability in Squid, a caching proxy for the Web, that allows a remote server to cause a Denial of Service by exploiting an Improper Validation of Specified Index bug.
Which versions of Squid are affected by CVE-2023-46724?
Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are affected by CVE-2023-46724.
What is the severity of CVE-2023-46724?
CVE-2023-46724 has a severity rating of 8.6, which is classified as high severity.
How can I fix CVE-2023-46724?
To fix CVE-2023-46724, update Squid to version 6.4 or later. Apply the patch provided by the official Squid-Cache website.
Where can I find more information about CVE-2023-46724?
You can find more information about CVE-2023-46724 on the official Squid-Cache website, as well as the GitHub security advisories and commit pages.