PT-2021-4613 · Squid+10 · Squid+11

Joshua Rogers · Published 2021-05-28 · Updated 2024-06-15 · CVE-2021-33620

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squid versions prior to 4.15 Squid versions 5.x prior to 5.0.6

Description The issue is related to insufficient input validation in the Squid proxy server, allowing a remote attacker to cause a denial of service, affecting availability to all clients. This can be triggered by an HTTP response with a header that can be expected to exist in HTTP traffic without any malicious intent by the server.

Recommendations For Squid versions prior to 4.15, update to version 4.15 or later. For Squid versions 5.x prior to 5.0.6, update to version 5.0.6 or later. As a temporary workaround, consider restricting access to the HTTP response header that triggers the issue until a patch is available.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2021:4292

ALT-PU-2021-2058

ALT-PU-2021-2829

BDU:2021-05301

CESA-2021_4292

CVE-2021-33620

DLA-2685-1

DSA-4924-1

GHSA-572G-RVWR-6C7F

MGASA-2021-0237

OESA-2021-1240

OPENSUSE-SU-2022_2553-1

OPENSUSE-SU-2024:11929-1

RHSA-2021:4292

RHSA-2021_4292

RLSA-2021:4292

SUSE-SU-2022:2367-1

SUSE-SU-2022:2553-1

SUSE-SU-2022_2367-1

SUSE-SU-2022_2553-1

USN-4981-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Squid

Squid Cache

Suse

Ubuntu

References · 86

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/squid_range_dos.rb · Exploit
• https://github.com/squid-cache/squid/security/advisories/GHSA-572g-rvwr-6c7f · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33620 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4981-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33620 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:2367-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-9465.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28651 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0237 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0237.html · Security Note
• http://squid-cache.org/Versions/v5/changesets/squid-5-8af775ed98bfd610f9ce762fe177e01b2675588c.patch · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2685-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4292 · Vendor Advisory