CVE-2024-23638: SQUID-2023:11 Denial of Service in Cache Manager
Last updated 24 July 2024
Other sources
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: httpaccess deny manager.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 4.13-10+deb11u3Fixed in 5.7-2+deb12u2Fixed in 6.13-1 - Upgrade
Upgrade
Squidto a version that resolves this vulnerability.Fixed in 6.6 - Configuration
As a workaround, prevent access to Cache Manager using Squid's main access control by configuring `http_access deny manager`.
Squid Cache Manager access control http_access deny manager = deny
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23638?
The severity of CVE-2024-23638 is classified as a Denial of Service vulnerability.
How do I fix CVE-2024-23638?
To fix CVE-2024-23638, upgrade Squid to version 6.6 or apply a relevant patch.
Which versions of Squid are affected by CVE-2024-23638?
Squid versions prior to 6.6 are affected by CVE-2024-23638.
What type of attack is associated with CVE-2024-23638?
CVE-2024-23638 is associated with a Denial of Service attack against Cache Manager error responses.
Can trusted clients exploit CVE-2024-23638?
Yes, trusted clients can exploit CVE-2024-23638 to perform Denial of Service attacks.