CVE-2023-49285: Denial of Service in HTTP Message Processing in Squid

Q: What is CVE-2023-49285?

CVE-2023-49285 is a vulnerability in Squid that allows for a Denial of Service attack.

Q: What is the severity of CVE-2023-49285?

CVE-2023-49285 has a severity rating of 8.6 (high).

Q: How does CVE-2023-49285 affect Squid?

CVE-2023-49285 affects Squid versions 6.4 and below.

Q: How can I fix CVE-2023-49285?

CVE-2023-49285 can be fixed by upgrading to Squid version 6.5.

Q: Are there any workarounds for CVE-2023-49285?

There are no known workarounds for CVE-2023-49285.

Published Dec 4, 2023

Updated

Last updated 24 July 2024

Other sources

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

— Launchpad

Affected Software

3 affected componentsFixes available

redhat/squid<6.5

6.5

Squid-Cache Squid<=6.4

debian/squid

5.7-2+deb12u55.7-2+deb12u66.13-2+deb13u36.13-2+deb13u47.8-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/squid to a version that resolves this vulnerability.
Fixed in 6.5
Upgrade
Upgrade debian/squid to a version that resolves this vulnerability.
Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u6Fixed in 6.13-2+deb13u3Fixed in 6.13-2+deb13u4Fixed in 7.8-1
Upgrade
Upgrade Squid to a version that resolves this vulnerability.
Fixed in 6.5

Event History

Dec 4, 2023

CVE Published

via MITRE·10:56 PM

Data Sourced

via MITRE·10:56 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5637

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3709-1

Frequently Asked Questions

What is CVE-2023-49285?