PT-2017-7677 · Squid+3 · Squid Http Proxy+4

Felix Hassert

·

Publicado

2016-12-19

·

Atualizado

2024-06-15

·

CVE-2016-10003

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Squid HTTP Proxy versions 3.5.0.1 through 3.5.22 Squid HTTP Proxy versions 4.0.1 through 4.0.16
Description The issue arises from an incorrect comparison of HTTP Request headers in the Squid HTTP Proxy, leading to the Collapsed Forwarding feature mistakenly identifying some private responses as suitable for delivery to multiple clients.
Recommendations For Squid HTTP Proxy versions 3.5.0.1 through 3.5.22, update to a version outside of this range to resolve the issue. For Squid HTTP Proxy versions 4.0.1 through 4.0.16, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the Collapsed Forwarding feature until a patch is available.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-697

Identificadores relacionados

ALT-PU-2016-2464
CVE-2016-10003
MGASA-2016-0423
OPENSUSE-SU-2024:11403-1
SUSE-SU-2017:0128-1
USN-3192-1

Produtos afetados

Alt Linux
Squid Cache
Squid Http Proxy
Suse
Ubuntu