CVE-2023-46846: Squid: request/response smuggling in http/1.1 and icap

Q: What is CVE-2023-46846?

CVE-2023-46846 is a vulnerability in Squid that allows a remote attacker to perform HTTP request smuggling past firewall and frontend security systems.

Q: How severe is CVE-2023-46846?

CVE-2023-46846 has a severity rating of 9.3 (Critical).

Q: How can I fix CVE-2023-46846?

To fix CVE-2023-46846, update your Squid software to version 6.4 or later.

Q: Which software versions are affected by CVE-2023-46846?

Squid versions up to 6.4 are affected by CVE-2023-46846.

Q: Where can I find more information about CVE-2023-46846?

You can find more information about CVE-2023-46846 on the Redhat advisory page: [link](https://access.redhat.com/errata/RHSA-2023:6266).

Published Oct 24, 2023

Updated

Description: Due to chunked decoder lenience Squid is vulnerable to Request/Response smuggling attacks when parsing HTTP/1.1 and ICAP messages

Reference: https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh

Affected versions: 2.6-6.3. Patched in 6.4.

Other sources

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

— Ubuntu

Affected Software

27 affected componentsFixes available

ubuntu/squid<4.10-1ubuntu1.8

4.10-1ubuntu1.8

ubuntu/squid<5.7-0ubuntu0.22.04.2

5.7-0ubuntu0.22.04.2

ubuntu/squid<5.7-1ubuntu3.1

5.7-1ubuntu3.1

ubuntu/squid<6.1-2ubuntu1.1

6.1-2ubuntu1.1

ubuntu/squid<6.1-2ubuntu2

6.1-2ubuntu2

ubuntu/squid<6.4

6.4

redhat/squid<6.4

6.4

Squid-Cache Squid>=2.6<6.4

redhat Enterprise Linux=8.0

redhat Enterprise Linux=9.0

redhat Enterprise Linux Eus=8.6

redhat Enterprise Linux Eus=8.8

redhat Enterprise Linux Eus=9.0

redhat Enterprise Linux Eus=9.2

redhat Enterprise Linux For Arm 64=8.0_aarch64

redhat Enterprise Linux For Ibm Z Systems=8.0_s390x

redhat Enterprise Linux For Power Little Endian=8.0_ppc64le

redhat Enterprise Linux Server Aus=8.2

redhat Enterprise Linux Server Aus=8.4

redhat Enterprise Linux Server Aus=8.6

redhat Enterprise Linux Server Aus=9.2

redhat Enterprise Linux Server Tus=8.2

redhat Enterprise Linux Server Tus=8.4

redhat Enterprise Linux Server Tus=8.6

redhat Enterprise Linux Server Tus=8.8

redhat Enterprise Linux Server Tus=9.2

debian/squid

5.7-2+deb12u55.7-2+deb12u66.13-2+deb13u36.13-2+deb13u47.7-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 4.10-1ubuntu1.8
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 5.7-0ubuntu0.22.04.2
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 5.7-1ubuntu3.1
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 6.1-2ubuntu1.1
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 6.1-2ubuntu2
Upgrade
Upgrade ubuntu/squid to a version that resolves this vulnerability.
Fixed in 6.4
Upgrade
Upgrade debian/squid to a version that resolves this vulnerability.
Fixed in 4.6-1+deb10u10Fixed in 4.13-10+deb11u3Fixed in 5.7-2+deb12u1Fixed in 6.9-1
Upgrade
Upgrade redhat/squid to a version that resolves this vulnerability.
Fixed in 6.4
Upgrade
Upgrade Squid to a version that resolves this vulnerability.
Fixed in 6.4

Event History

Nov 3, 2023

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·07:33 AM

Data Sourced

via MITRE·07:33 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3709-1

Frequently Asked Questions

What is CVE-2023-46846?