PT-2021-5368 · Squid · Squid+1

Jean-Paul Larocque · Published 2021-10-04 · Updated 2022-03-31 · CVE-2021-41611

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Squid versions 5.0.6 through 5.1.x

Description An issue was discovered in Squid when validating an origin server or peer certificate, which may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust improperly, and this indication of trust may be passed along to clients, allowing access to unsafe or hijacked services. The vulnerability is related to errors in certificate authentication and can be exploited by a remote attacker to perform a man-in-the-middle attack.

Recommendations For Squid versions 5.0.6 through 5.1.x, update to version 5.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of certificate validation until a patch is available. Avoid using the vulnerable certificate validation mechanism in Squid until the issue is resolved.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2021-06198

CVE-2021-41611

GHSA-47M4-G3MV-9Q5R

Affected Products

Squid

Squid Cache

References · 18

• https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-41611 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-41611 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06198 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41611 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CWQ2WKDWTSO47S3F6XJJ6HGG2ULWEAE4 · Vendor Advisory
• http://squid-cache.org/Versions/v6/changesets/squid-6-43d6b5c81b88ec2256b430c69a872a1e4f324e4a.patch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41611 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41611 · Vendor Advisory
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://security.alpinelinux.org/vuln/CVE-2021-41611 · Note
• http://openwall.com/lists/oss-security/2021/12/23/2 · Note
• https://redos.red-soft.ru/updatesec · Note
• https://t.me/cvenotify/23866 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021100402 · Note