CVE-2023-49285: Denial of Service in HTTP Message Processing in Squid
Published Dec 4, 2023
·Updated
Last updated 24 July 2024
Other sources
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— Launchpad
Affected Software
3 affected componentsFixes available
redhat/squid<6.5
6.5
Squid-Cache Squid<=6.4
debian/squid
4.13-10+deb11u35.7-2+deb12u26.13-1
Remediation
Patch Available
Patch Available
Event History
Dec 4, 2023
CVE Published
via MITRE·10:56 PM
Data Sourced
via MITRE·10:56 PM
DescriptionSeverityWeakness
Jan 27, 2024
Data Sourced
via Launchpad·04:32 AM
Description
Sep 15, 2024
Data Sourced
via Ubuntu·05:07 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2023-49285?
CVE-2023-49285 is a vulnerability in Squid that allows for a Denial of Service attack.
2
What is the severity of CVE-2023-49285?
CVE-2023-49285 has a severity rating of 8.6 (high).
3
How does CVE-2023-49285 affect Squid?
CVE-2023-49285 affects Squid versions 6.4 and below.
4
How can I fix CVE-2023-49285?
CVE-2023-49285 can be fixed by upgrading to Squid version 6.5.
5
Are there any workarounds for CVE-2023-49285?
There are no known workarounds for CVE-2023-49285.