REDHAT-BUG-2294353: Medium severity squid web proxy cache vulnerability
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
References: https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
Upstream patch: https://github.com/squid-cache/squid/commit/f411fe7d75197852f0e5ee85027a06d58dd8df4c.patch
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2294353?
The severity of REDHAT-BUG-2294353 is high due to its potential to cause a Denial of Service via memory corruption.
How do I fix REDHAT-BUG-2294353?
To fix REDHAT-BUG-2294353, it's recommended to upgrade to the latest version of Squid that addresses this vulnerability.
What are the potential impacts of REDHAT-BUG-2294353?
The main impact of REDHAT-BUG-2294353 is the potential for Denial of Service attacks caused by memory corruption.
Which versions of Squid are affected by REDHAT-BUG-2294353?
Various versions of Squid are affected by REDHAT-BUG-2294353; check the official advisories for specific version details.
Is there a workaround for REDHAT-BUG-2294353?
Currently, there are no known workarounds for REDHAT-BUG-2294353 other than applying the available patches or updates.