Описание
Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This bug is fixed in the default build configuration of Squid version 6.10.
A flaw was found in Squid. When configured as a reverse proxy with Edge Side Includes (ESI) enabled, improper input validation and resource handling during the processing of ESI response content allow an upstream server to cause a Denial of Service (DoS). By returning specially crafted ESI markup or oversized headers, a malicious server can crash the proxy process or exhaust system resources, disrupting service for all connected clients.
Отчет
This vulnerability is rated as Important severity because an unauthenticated remote entity can trigger an unhandled failure in the Squid daemon, leading to an immediate denial of service that disrupts caching and proxying operations for all users. In Red Hat Enterprise Linux, Squid packages are built with Edge Side Includes (ESI) support active, which exposes instances configured in reverse-proxy or accelerator topologies to malformed responses from upstream servers. Standard forward proxy deployments that do not inspect or parse ESI elements from backend HTTP servers are not vulnerable to this condition.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | squid | Not affected | ||
| Red Hat Enterprise Linux 6 | squid | Out of support scope | ||
| Red Hat Enterprise Linux 6 | squid34 | Out of support scope | ||
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | squid | Fixed | RHSA-2024:9738 | 14.11.2024 |
| Red Hat Enterprise Linux 8 | squid | Fixed | RHSA-2024:9644 | 14.11.2024 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | squid | Fixed | RHSA-2024:9624 | 14.11.2024 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | squid | Fixed | RHSA-2024:9815 | 18.11.2024 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | squid | Fixed | RHSA-2024:9815 | 18.11.2024 |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | squid | Fixed | RHSA-2024:9815 | 18.11.2024 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | squid | Fixed | RHSA-2024:9814 | 18.11.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This bug is fixed in the default build configuration of Squid version 6.10.
Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This bug is fixed in the default build configuration of Squid version 6.10.
Squid is an open source caching proxy for the Web supporting HTTP, HTT ...
EPSS
7.5 High
CVSS3