GHSA-rj5h-46j6-q2g5: Denial of Service in HTTP Collapsed Forwarding in Squid

Q: Which deployments are affected?

Squid versions 3.5 through 5.9, inclusive, are affected only when configured with "collapsed_forwarding on". Deployments with "collapsed_forwarding off" or no "collapsed_forwarding" directive are not vulnerable.

Q: Does exploitation require authentication or user interaction?

No. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.

Q: What can be done if upgrading is not immediately possible?

Remove all collapsed_forwarding lines from squid.conf. Leaving the directive absent is not vulnerable according to the advisory.

Q: How can I remediate the issue permanently?

Upgrade Squid to version 6.0.1, which fixes the use-after-free flaw.

Published Dec 4, 2023

Updated

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsedforwarding on" are vulnerable. Configurations with "collapsedforwarding off" or without a "collapsedforwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsedforwarding lines from their squid.conf.

Affected Software

1 affected component

Squid Squid>=3.5<=5.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Squid to a version that resolves this vulnerability.
Fixed in 6.0.1
Configuration
If unable to upgrade, remove all collapsed_forwarding lines from squid.conf.
Squid collapsed_forwarding = removed

Event History

Dec 4, 2023

CVE Published

via OSV·10:49 PM

Data Sourced

via OSV·10:49 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Squid versions 3.5 through 5.9, inclusive, are affected only when configured with "collapsed_forwarding on". Deployments with "collapsed_forwarding off" or no "collapsed_forwarding" directive are not vulnerable.

Does exploitation require authentication or user interaction?

No. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.

What can be done if upgrading is not immediately possible?

Remove all collapsed_forwarding lines from squid.conf. Leaving the directive absent is not vulnerable according to the advisory.

How can I remediate the issue permanently?

Upgrade Squid to version 6.0.1, which fixes the use-after-free flaw.

GHSA-rj5h-46j6-q2g5: Denial of Service in HTTP Collapsed Forwarding in Squid

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What can be done if upgrading is not immediately possible?

How can I remediate the issue permanently?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What can be done if upgrading is not immediately possible?

How can I remediate the issue permanently?