CVE-2020-24606

Опубликовано: 24 авг. 2020

Источник: nvd

CVSS3: 8.6

CVSS3: 7.5

CVSS2: 7.1

EPSS Низкий

Описание

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html
Mailing List
Third Party Advisory
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patch
Patch
Vendor Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2CKGFPZ4G4R5DIIPHWI3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/
https://security.netapp.com/advisory/ntap-20210219-0007/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210226-0006/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210226-0007/
Broken Link
https://usn.ubuntu.com/4477-1/
Third Party Advisory
https://usn.ubuntu.com/4551-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4751
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html
Mailing List
Third Party Advisory
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patch
Patch
Vendor Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2/

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Версия от 3.0 (включая) до 4.13 (исключая)

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Версия от 5.0.1 (включая) до 5.0.4 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.06342

Низкий

8.6 High

CVSS3

7.5 High

CVSS3

7.1 High

CVSS2

Дефекты

CWE-667

Связанные уязвимости

CVE-2020-24606

CVSS3: 8.6

ubuntu

почти 5 лет назад

CVE-2020-24606

CVSS3: 7.5

redhat

почти 5 лет назад

CVE-2020-24606

CVSS3: 8.6

debian

почти 5 лет назад

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perfor ...

BDU:2021-01722

CVSS3: 7.5

fstec

почти 5 лет назад

Уязвимость функции peerDigestHandleReply() прокси-сервера Squid, связанная с недостатком механизма проверки вводимых данных, позволяющая нарушителю вызвать отказ в обслуживании

SUSE-SU-2020:2471-1

suse-cvrf

почти 5 лет назад

Security update for squid

EPSS

Процентиль: 91%

0.06342

Низкий

8.6 High

CVSS3

7.5 High

CVSS3

7.1 High

CVSS2

Дефекты

CWE-667