CVE-2023-5824: Squid: dos against http and https
First published: Tue Oct 24 2023(Updated: )
A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Squid-Cache Squid | <6.4 | |
| Redhat Enterprise Linux | =6.0 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux | =9.0 | |
| redhat/squid | <6.4 | 6.4 |
| debian/squid | <=4.13-10+deb11u3<=5.7-2+deb12u2 | 6.12-1 |
| <6.4 | ||
| =6.0 | ||
| =7.0 | ||
| =8.0 | ||
| =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2245915
- https://access.redhat.com/errata/RHSA-2023:7465
- https://access.redhat.com/errata/RHSA-2023:7668
- https://access.redhat.com/errata/RHSA-2024:0072
- https://access.redhat.com/errata/RHSA-2024:0397
- https://access.redhat.com/errata/RHSA-2024:0772
- https://access.redhat.com/errata/RHSA-2024:0773
- https://access.redhat.com/errata/RHSA-2024:0771
- https://access.redhat.com/errata/RHSA-2024:1153
- https://bugzilla.redhat.com/show_bug.cgi?id=2245914
- https://access.redhat.com/security/cve/CVE-2023-5824
- https://security.netapp.com/advisory/ntap-20231130-0003/
- https://launchpad.net/bugs/cve/CVE-2023-5824
- https://megamansec.github.io/Squid-Security-Audit/cache-headers.html
- https://security-tracker.debian.org/tracker/CVE-2023-5824
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5824
- https://nvd.nist.gov/vuln/detail/CVE-2023-5824
- https://ubuntu.com/security/CVE-2023-5824
Frequently Asked Questions
What is the vulnerability ID for this Squid vulnerability?
The vulnerability ID for this Squid vulnerability is CVE-2023-5824.
What is the title of this vulnerability?
The title of this vulnerability is 'Squid: dos against http and https'.
What is the description of this vulnerability?
The description of this vulnerability is 'Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug.'
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is critical (9.6).
What software is affected by this vulnerability?
The affected software is Squid version up to (but not including) 6.4, Redhat Enterprise Linux versions 6.0 to 9.0.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following references: [1](https://access.redhat.com/security/cve/CVE-2023-5824), [2](https://bugzilla.redhat.com/show_bug.cgi?id=2245914), [3](https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255).
- agent/type
- agent/first-publish-date
- agent/title
- agent/severity
- agent/weakness
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/remedy
- agent/author
- collector/launchpad-cve
- source/Launchpad
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-5824
- agent/software-canonical-lookup
- collector/security-tracker-debian
- source/Debian
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/softwarecombine
- collector/nvd-cve
- agent/trending
- package-manager/redhat
- package-manager/debian
- vendor/squid-cache
- canonical/squid-cache squid
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/6.0
- version/redhat enterprise linux/7.0
- version/redhat enterprise linux/8.0
- version/redhat enterprise linux/9.0