Описание
An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.
An input validation flaw was found in Squid. This issue could allow a remote server to perform a denial of service against all clients using the proxy when delivering HTTP response messages. The highest threat from this vulnerability is to system availability.
Отчет
The versions of squid as shipped with Red Hat Enterprise Linux 6 and 7 are not affected by this flaw, as the vulnerable code was introduced in a later version of the package.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | squid | Not affected | ||
| Red Hat Enterprise Linux 6 | squid34 | Not affected | ||
| Red Hat Enterprise Linux 7 | squid | Not affected | ||
| Red Hat Enterprise Linux 9 | squid | Not affected | ||
| Red Hat Enterprise Linux 8 | squid | Fixed | RHSA-2021:4292 | 09.11.2021 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.
An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.
An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. ...
Уязвимость прокси-сервера Squid, существующая из-за недостаточной проверки ввода при обработке ответов HTTP, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
6.5 Medium
CVSS3