CVE-2023-46724: SQUID-2023:4 Denial of Service in SSL Certificate validation

Q: What is CVE-2023-46724?

CVE-2023-46724 is a vulnerability in Squid, a caching proxy for the Web, that allows a remote server to cause a Denial of Service by exploiting an Improper Validation of Specified Index bug.

Q: What is the severity of CVE-2023-46724?

CVE-2023-46724 has a severity rating of 8.6, which is classified as high severity.

Q: How can I fix CVE-2023-46724?

To fix CVE-2023-46724, update Squid to version 6.4 or later. Apply the patch provided by the official Squid-Cache website.

Q: Where can I find more information about CVE-2023-46724?

You can find more information about CVE-2023-46724 on the official Squid-Cache website, as well as the GitHub security advisories and commit pages.

Published Nov 1, 2023

Updated

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.

Affected Software

7 affected componentsFixes available

redhat/squid<6.4

6.4

ubuntu/squid<5.7-0ubuntu0.22.04.2

5.7-0ubuntu0.22.04.2

ubuntu/squid<5.7-1ubuntu3.1

5.7-1ubuntu3.1

ubuntu/squid<6.1-2ubuntu1.1

6.1-2ubuntu1.1

ubuntu/squid<6.1-2ubuntu2

6.1-2ubuntu2

Squid-Cache Squid>=3.3.0.1<6.4

debian/squid

5.7-2+deb12u55.7-2+deb12u66.13-2+deb13u36.13-2+deb13u47.8-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/squid to a version that resolves this vulnerability.
Fixed in 6.4
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 5.7-0ubuntu0.22.04.2
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 5.7-1ubuntu3.1
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 6.1-2ubuntu1.1
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 6.1-2ubuntu2
Upgrade
Upgrade debian/squid to a version that resolves this vulnerability.
Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u6Fixed in 6.13-2+deb13u3Fixed in 6.13-2+deb13u4Fixed in 7.8-1
Upgrade
Upgrade Squid to a version that resolves this vulnerability.
Fixed in 6.4Patch SQUID-2023_4.patch

Event History

Nov 1, 2023

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·07:09 PM

Data Sourced

via MITRE·07:09 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2023-46724?

CVE-2023-46724 is a vulnerability in Squid, a caching proxy for the Web, that allows a remote server to cause a Denial of Service by exploiting an Improper Validation of Specified Index bug.

Which versions of Squid are affected by CVE-2023-46724?

Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are affected by CVE-2023-46724.

What is the severity of CVE-2023-46724?