CVE-2023-49286: Denial of Service in Helper Process management
Last updated 24 July 2024
Other sources
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/squidto a version that resolves this vulnerability.Fixed in 6.5 - Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u6Fixed in 6.13-2+deb13u3Fixed in 6.13-2+deb13u4Fixed in 7.8-1 - Upgrade
Upgrade
Squidto a version that resolves this vulnerability.Fixed in 6.5
Event History
Frequently Asked Questions
What is CVE-2023-49286?
CVE-2023-49286 is a vulnerability in Squid, a caching proxy for the Web, that allows for a Denial of Service attack against its Helper process management.
What is the severity of CVE-2023-49286?
The severity of CVE-2023-49286 is high, with a severity value of 8.6.
How does CVE-2023-49286 affect Squid?
CVE-2023-49286 affects Squid versions up to and including 6.4.
How can I fix CVE-2023-49286?
CVE-2023-49286 can be fixed by upgrading to Squid version 6.5 or later.
Where can I find more information about CVE-2023-49286?
More information about CVE-2023-49286 can be found in the following references: [GitHub Advisory](https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27), [GitHub Commit](https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264), [Squid Patch](http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch).