REDHAT-BUG-1334786: Medium severity squid web proxy cache vulnerability

Published May 10, 2016

Updated

Due to incorrect reference counting Squid is vulnerable to a denial of service attack when processing ESI responses.

External references:

http://www.squid-cache.org/Advisories/SQUID-20169.txt

Upstream fixes:

Squid 3.5:

http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-20169.patch

Squid 3.4:

http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-20169.patch

NOTE: For the other related CVE, CVE-2016-4555, see Bug 1334246

Affected Software

1 affected component

Squid Squid>=3.4, >=3.5

May 10, 2016

Data Sourced

via Red Hat·02:18 PM

DescriptionSeverityAffected Software

REDHAT-BUG-1334786 has a high severity due to its potential to cause a denial of service attack.

To fix REDHAT-BUG-1334786, update to Squid version 3.5 or later.

REDHAT-BUG-1334786 affects Squid versions 3.4 and 3.5.

REDHAT-BUG-1334786 is a denial of service vulnerability due to incorrect reference counting.

More information about REDHAT-BUG-1334786 can be found in the Squid advisory.