PT-2021-3109 · Squid+9 · Squid+10

Joshua Rogers · Published 2021-05-10 · Updated 2024-06-27 · CVE-2021-28651

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions prior to 4.15 Squid versions 5.x prior to 5.0.6

Description The issue exists due to insufficient input validation when resolving urn: scheme identifiers, allowing a remote attacker to cause a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.

Recommendations For Squid versions prior to 4.15, update to version 4.15 or later to resolve the issue. For Squid versions 5.x prior to 5.0.6, update to version 5.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the urn: scheme to minimize the risk of exploitation.

Exploit

Fix

DoS

Memory Leak

RCE

Weakness Enumeration

CWE-401

CWE-20

Related Identifiers

ALSA-2021:4292

ALT-PU-2021-2058

ALT-PU-2021-2829

BDU:2021-02732

CESA-2021_4292

CVE-2021-28651

DLA-2685-1

DSA-4924-1

GHSA-CH36-9JHX-PHM4

MGASA-2021-0237

OESA-2021-1240

OPENSUSE-SU-2021:0879-1

OPENSUSE-SU-2021:1961-1

OPENSUSE-SU-2021_0879-1

OPENSUSE-SU-2021_1961-1

OPENSUSE-SU-2024:11403-1

RHSA-2021:4292

RHSA-2021_4292

RHSA-2025:14414

RLSA-2021:4292

SUSE-SU-2021:1838-1

SUSE-SU-2021:1961-1

SUSE-SU-2022:14914-1

SUSE-SU-2022:2392-1

SUSE-SU-2022_14914-1

USN-4981-1

USN-6857-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Squid

Squid Cache

Suse

Ubuntu

References · 153

• 🔥 https://bugs.squid-cache.org/show_bug.cgi?id=5104 · Exploit
• https://github.com/squid-cache/squid/security/advisories/GHSA-ch36-9jhx-phm4 · Patch
• https://osv.dev/vulnerability/USN-4981-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33620 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-9465.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28651 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2685-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31806 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2021-28651 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4981-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4292 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31807 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1961-1 · Vendor Advisory