SUSE-SU-2024:0298-1: Security update for squid

Q: Which environments are identified as affected by this update?

The update applies to Squid packages on SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS and 15 SP3 LTSS, SUSE Linux Enterprise Server 15 SP2 LTSS and 15 SP3 LTSS, and SUSE Linux Enterprise Server for SAP Applications 15 SP2. Listed architectures include aarch64, x86_64, ppc64le, and s390x, depending on the product.

Q: Are debug-related packages included in the update scope?

Yes. The listed software includes squid, squid-debuginfo, and squid-debugsource.

Q: Does the advisory provide a temporary mitigation if the update cannot be installed immediately?

No temporary mitigations or configuration workarounds are provided in the supplied advisory data.

Q: Can the supplied information be used to confirm whether a specific installed Squid version is fixed?

No. The supplied data identifies affected SUSE product releases and packages but does not provide fixed or vulnerable Squid version numbers.

Published Feb 1, 2024

Updated

This update for squid fixes the following issues: CVE-2023-50269: fixed X-Forwarded-For Stack Overflow. (bsc#1217654) CVE-2024-23638: fixed Denial of Service attack against Cache Manager error responses. (bsc#1219131)

Affected Software

28 affected componentsFixes available

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64)

Any of the following

suse/squid-debugsource<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid-debuginfo<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid<4.17-150000.5.49.1

4.17-150000.5.49.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64)

Any of the following

suse/squid-debugsource<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid-debuginfo<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid<4.17-150000.5.49.1

4.17-150000.5.49.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/squid-debugsource<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid-debuginfo<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid<4.17-150000.5.49.1

4.17-150000.5.49.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/squid-debugsource<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid-debuginfo<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid<4.17-150000.5.49.1

4.17-150000.5.49.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)

Any of the following

suse/squid-debugsource<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid-debuginfo<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid<4.17-150000.5.49.1

4.17-150000.5.49.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)

Any of the following

suse/squid-debugsource<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid-debuginfo<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid<4.17-150000.5.49.1

4.17-150000.5.49.1

All of the following

SUSE SUSE Enterprise Storage 7.1 (aarch64 x86_64)

Any of the following

suse/squid-debugsource<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid-debuginfo<4.17-150000.5.49.1

4.17-150000.5.49.1

suse/squid<4.17-150000.5.49.1

4.17-150000.5.49.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/squid-debugsource to a version that resolves this vulnerability.
Fixed in 4.17-150000.5.49.1
Upgrade
Upgrade suse/squid-debuginfo to a version that resolves this vulnerability.
Fixed in 4.17-150000.5.49.1
Upgrade
Upgrade suse/squid to a version that resolves this vulnerability.
Fixed in 4.17-150000.5.49.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-298=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-298=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-298=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-298=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-298=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-298=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2024-298=1

Event History

Feb 1, 2024

Advisory Published

via SUSE·04:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which environments are identified as affected by this update?

The update applies to Squid packages on SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS and 15 SP3 LTSS, SUSE Linux Enterprise Server 15 SP2 LTSS and 15 SP3 LTSS, and SUSE Linux Enterprise Server for SAP Applications 15 SP2. Listed architectures include aarch64, x86_64, ppc64le, and s390x, depending on the product.

Are debug-related packages included in the update scope?

Yes. The listed software includes squid, squid-debuginfo, and squid-debugsource.

Does the advisory provide a temporary mitigation if the update cannot be installed immediately?

No temporary mitigations or configuration workarounds are provided in the supplied advisory data.

Can the supplied information be used to confirm whether a specific installed Squid version is fixed?

No. The supplied data identifies affected SUSE product releases and packages but does not provide fixed or vulnerable Squid version numbers.

SUSE-SU-2024:0298-1: Security update for squid

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which environments are identified as affected by this update?

Are debug-related packages included in the update scope?

Does the advisory provide a temporary mitigation if the update cannot be installed immediately?

Can the supplied information be used to confirm whether a specific installed Squid version is fixed?

Company

Resources

Contact

Frequently Asked Questions

Which environments are identified as affected by this update?

Are debug-related packages included in the update scope?

Does the advisory provide a temporary mitigation if the update cannot be installed immediately?

Can the supplied information be used to confirm whether a specific installed Squid version is fixed?