CVE-2023-49286: Denial of Service in Helper Process management
First published: Mon Dec 04 2023(Updated: )
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Squid-Cache Squid | <=6.4 | |
| debian/squid | <=4.6-1+deb10u7<=4.13-10+deb11u2<=5.7-2 | 4.6-1+deb10u10 4.13-10+deb11u3 5.7-2+deb12u1 6.6-1 6.9-1 |
| redhat/squid | <6.5 | 6.5 |
| ubuntu/squid | <4.10-1ubuntu1.9 | 4.10-1ubuntu1.9 |
| ubuntu/squid | <5.7-0ubuntu0.22.04.3 | 5.7-0ubuntu0.22.04.3 |
| ubuntu/squid | <5.7-1ubuntu3.2 | 5.7-1ubuntu3.2 |
| ubuntu/squid | <6.1-2ubuntu1.2 | 6.1-2ubuntu1.2 |
| ubuntu/squid | <6.5-1ubuntu1 | 6.5-1ubuntu1 |
| ubuntu/squid | <6.5-1 | 6.5-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27
- https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264
- http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
- https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
- https://security.netapp.com/advisory/ntap-20240119-0004/
- https://launchpad.net/bugs/cve/CVE-2023-49286
- https://security-tracker.debian.org/tracker/CVE-2023-49286
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2252924
- https://access.redhat.com/errata/RHSA-2024:0046
- https://access.redhat.com/errata/RHSA-2024:0072
- https://access.redhat.com/errata/RHSA-2024:0071
- https://access.redhat.com/errata/RHSA-2024:0397
- https://access.redhat.com/errata/RHSA-2024:0772
- https://access.redhat.com/errata/RHSA-2024:0773
- https://access.redhat.com/errata/RHSA-2024:0771
- https://access.redhat.com/errata/RHSA-2024:1153
- https://access.redhat.com/errata/RHSA-2024:1787
- https://bugzilla.redhat.com/show_bug.cgi?id=2252923
- https://megamansec.github.io/Squid-Security-Audit/ipc-assert.html
- https://ubuntu.com/security/notices/USN-6594-1
- https://www.cve.org/CVERecord?id=CVE-2023-49286
- https://nvd.nist.gov/vuln/detail/CVE-2023-49286
- https://ubuntu.com/security/CVE-2023-49286
Frequently Asked Questions
What is CVE-2023-49286?
CVE-2023-49286 is a vulnerability in Squid, a caching proxy for the Web, that allows for a Denial of Service attack against its Helper process management.
What is the severity of CVE-2023-49286?
The severity of CVE-2023-49286 is high, with a severity value of 8.6.
How does CVE-2023-49286 affect Squid?
CVE-2023-49286 affects Squid versions up to and including 6.4.
How can I fix CVE-2023-49286?
CVE-2023-49286 can be fixed by upgrading to Squid version 6.5 or later.
Where can I find more information about CVE-2023-49286?
More information about CVE-2023-49286 can be found in the following references: [GitHub Advisory](https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27), [GitHub Commit](https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264), [Squid Patch](http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch).
- agent/type
- agent/weakness
- agent/title
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/description
- agent/first-publish-date
- collector/nvd-cve
- agent/author
- collector/launchpad-cve
- source/Launchpad
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-49286
- agent/references
- agent/last-modified-date
- agent/tags
- collector/usn-cve
- source/Ubuntu
- vendor/squid-cache
- canonical/squid-cache squid
- version/squid-cache squid/6.4
- package-manager/debian
- package-manager/redhat
- package-manager/ubuntu