CVE-2023-5824: Squid: dos against http and https
A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service.
Other sources
Description: a) Due to an Improper Handling of Structural Elements bug Squid is vulnerable to a Denial of Service attack against HTTP and HTTPS clients.
b) Due to an Incomplete Filtering of Special Elements bug Squid is vulnerable to a Denial of Service attack against HTTP and HTTPS clients.
Reference: https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255
Affected versions: < 6.4
— Red Hat
Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/squidto a version that resolves this vulnerability.Fixed in 6.4 - Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 5.7-2+deb12u3 - Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 6.5-1 - Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u6Fixed in 6.13-2+deb13u3Fixed in 6.13-2+deb13u4Fixed in 7.8-1 - Upgrade
Upgrade
Squidto a version that resolves this vulnerability.Fixed in 6.4
Event History
Frequently Asked Questions
What is the vulnerability ID for this Squid vulnerability?
The vulnerability ID for this Squid vulnerability is CVE-2023-5824.
What is the title of this vulnerability?
The title of this vulnerability is 'Squid: dos against http and https'.
What is the description of this vulnerability?
The description of this vulnerability is 'Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug.'
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is critical (9.6).
What software is affected by this vulnerability?
The affected software is Squid version up to (but not including) 6.4, Redhat Enterprise Linux versions 6.0 to 9.0.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following references: [1](https://access.redhat.com/security/cve/CVE-2023-5824), [2](https://bugzilla.redhat.com/show_bug.cgi?id=2245914), [3](https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255).