CVE-2023-49285: Denial of Service in HTTP Message Processing in Squid
First published: Mon Dec 04 2023(Updated: )
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Squid-Cache Squid | <=6.4 | |
| debian/squid | <=4.6-1+deb10u7<=4.13-10+deb11u2<=5.7-2 | 4.6-1+deb10u10 4.13-10+deb11u3 5.7-2+deb12u1 6.6-1 6.9-1 |
| redhat/squid | <6.5 | 6.5 |
| ubuntu/squid | <4.10-1ubuntu1.9 | 4.10-1ubuntu1.9 |
| ubuntu/squid | <5.7-0ubuntu0.22.04.3 | 5.7-0ubuntu0.22.04.3 |
| ubuntu/squid | <5.7-1ubuntu3.2 | 5.7-1ubuntu3.2 |
| ubuntu/squid | <6.1-2ubuntu1.2 | 6.1-2ubuntu1.2 |
| ubuntu/squid | <6.5-1ubuntu1 | 6.5-1ubuntu1 |
| ubuntu/squid | <6.5-1 | 6.5-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9
- https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521b
- https://github.com/squid-cache/squid/commit/deee944f9a12c9fd399ce52f3e2526bb573a9470
- http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patch
- http://www.squid-cache.org/Versions/v6/SQUID-2023_7.patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
- https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
- https://security.netapp.com/advisory/ntap-20240119-0004/
- https://launchpad.net/bugs/cve/CVE-2023-49285
- https://security-tracker.debian.org/tracker/CVE-2023-49285
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2252927
- https://access.redhat.com/errata/RHSA-2024:0046
- https://access.redhat.com/errata/RHSA-2024:0072
- https://access.redhat.com/errata/RHSA-2024:0071
- https://access.redhat.com/errata/RHSA-2024:0397
- https://access.redhat.com/errata/RHSA-2024:0772
- https://access.redhat.com/errata/RHSA-2024:0773
- https://access.redhat.com/errata/RHSA-2024:0771
- https://access.redhat.com/errata/RHSA-2024:1153
- https://access.redhat.com/errata/RHSA-2024:1787
- https://bugzilla.redhat.com/show_bug.cgi?id=2252926
- https://megamansec.github.io/Squid-Security-Audit/datetime-overflow.html
- https://ubuntu.com/security/notices/USN-6594-1
- https://www.cve.org/CVERecord?id=CVE-2023-49285
- https://nvd.nist.gov/vuln/detail/CVE-2023-49285
- https://ubuntu.com/security/CVE-2023-49285
Frequently Asked Questions
What is CVE-2023-49285?
CVE-2023-49285 is a vulnerability in Squid that allows for a Denial of Service attack.
What is the severity of CVE-2023-49285?
CVE-2023-49285 has a severity rating of 8.6 (high).
How does CVE-2023-49285 affect Squid?
CVE-2023-49285 affects Squid versions 6.4 and below.
How can I fix CVE-2023-49285?
CVE-2023-49285 can be fixed by upgrading to Squid version 6.5.
Are there any workarounds for CVE-2023-49285?
There are no known workarounds for CVE-2023-49285.
- agent/weakness
- agent/type
- agent/title
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/author
- collector/nvd-cve
- collector/launchpad-cve
- source/Launchpad
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-49285
- agent/references
- agent/last-modified-date
- agent/tags
- collector/usn-cve
- source/Ubuntu
- vendor/squid-cache
- canonical/squid-cache squid
- version/squid-cache squid/6.4
- package-manager/debian
- package-manager/redhat
- package-manager/ubuntu