PT-2020-2568 · Squid+7 · Squid+8

Guido Vranken · Published 2020-02-04 · Updated 2021-07-21 · CVE-2020-8450

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Squid versions prior to 4.10

Description An issue was discovered due to incorrect buffer management, allowing a remote client to cause a buffer overflow in a Squid instance acting as a reverse proxy. This can potentially impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 4.10, update to version 4.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the reverse proxy functionality until a patch is available.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

CWE-131

Related Identifiers

ALSA-2020:4743

ALT-PU-2020-1479

ALT-PU-2020-1494

BDU:2020-02597

CESA-2020_4082

CESA-2020_4743

CVE-2020-8450

DLA-2278-1

DSA-4682-1

MGASA-2020-0106

OPENSUSE-SU-2020:0307-1

OPENSUSE-SU-2020:0606-1

OPENSUSE-SU-2020_0307-1

OPENSUSE-SU-2020_0606-1

RHSA-2020:4082

RHSA-2020:4743

RHSA-2020_4082

RHSA-2020_4743

RLSA-2020:4743

SUSE-SU-2020:0487-1

SUSE-SU-2020:0493-1

SUSE-SU-2020:0661-1

SUSE-SU-2020:14460-1

USN-4289-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Rocky Linux

Squid

Squid Cache

Suse

Ubuntu

References · 136

• https://linux.oracle.com/errata/ELSA-2020-4082.html · Vendor Advisory
• http://squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch · Vendor Advisory
• http://squid-cache.org/Versions/v4/changesets/squid-4-d8e4715992d0e530871519549add5519cbac0598.patch · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8450 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0661-1 · Vendor Advisory
• http://squid-cache.org/Advisories/SQUID-2020_1.txt · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0106 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4289-1 · Vendor Advisory
• http://squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4682-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-8450 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0493-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14460-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0106.html · Security Note