PT-2020-5763 · Squid+8 · Squid+9
Lubos Uhliarik
·
Published
2020-08-24
·
Updated
2024-06-15
·
CVE-2020-24606
CVSS v3.1
8.6
High
| Vector | AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N |
Name of the Vulnerable Software and Affected Versions:
Squid versions prior to 4.13
Squid versions 5.x prior to 5.0.4
Description:
The issue is related to a lack of input validation in the peerDigestHandleReply() function of the Squid proxy server. This can be exploited by a remote attacker to cause a denial of service. The problem occurs when the cache peer feature is used with cache digests and a trusted peer sends a crafted Cache Digest response message, causing the peerDigestHandleReply() function to mishandle EOF and consume all available CPU cycles.
Recommendations:
For Squid versions prior to 4.13, update to version 4.13 or later to resolve the issue.
For Squid versions 5.x prior to 5.0.4, update to version 5.0.4 or later to resolve the issue.
As a temporary workaround, consider disabling the cache digests feature when using cache peer to minimize the risk of exploitation.
Fix
DoS
RCE
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Red Hat
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu