REDHAT-BUG-2404736: High severity Squid Squid vulnerability
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with emailerrdata off.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2404736?
The severity of REDHAT-BUG-2404736 is considered high due to the potential for information disclosure of authentication credentials.
How do I fix REDHAT-BUG-2404736?
To fix REDHAT-BUG-2404736, upgrade to Squid version 7.2 or later which contains the necessary patches.
What are the potential impacts of REDHAT-BUG-2404736?
The potential impacts of REDHAT-BUG-2404736 include unauthorized access to sensitive authentication credentials through script exploitation.
Which versions of Squid are affected by REDHAT-BUG-2404736?
Squid versions prior to 7.2 are affected by REDHAT-BUG-2404736.
Is there a workaround for REDHAT-BUG-2404736?
There are no known effective workarounds for REDHAT-BUG-2404736 other than upgrading the software.