PT-2022-6123 · Squid+6 · Squid+7

Konata + 1 · Published 2022-09-18 · Updated 2024-06-27 · CVE-2022-41317

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Squid versions 4.9 through 4.17 Squid versions 5.0.6 through 5.6

Description An issue was discovered due to inconsistent handling of internal URIs, which can lead to Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This may allow a remote attacker to bypass ACL protection and access cache manager information, including network structure, client credentials, client identifier, and client traffic behavior.

Recommendations For Squid versions 4.9 through 4.17, update to a version newer than 5.7 to resolve the issue. For Squid versions 5.0.6 through 5.6, update to version 5.7 or newer to resolve the issue. As a temporary workaround, consider restricting access to the internal cache manager URL to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-697

CWE-284

Related Identifiers

ALT-PU-2022-2631

ALT-PU-2023-5843

ALT-PU-2023-6467

ALT-PU-2024-9370

BDU:2023-00066

CVE-2022-41317

DLA-3151-1

DSA-5258-1

GHSA-RCG9-7FQM-83MQ

MGASA-2022-0351

OESA-2022-1974

OPENSUSE-SU-2022_3531-1

OPENSUSE-SU-2022_3596-1

OPENSUSE-SU-2024:12364-1

ROSA-SA-2023-2273

SUSE-SU-2022:3531-1

SUSE-SU-2022:3532-1

SUSE-SU-2022:3533-1

SUSE-SU-2022:3596-1

SUSE-SU-2022_3531-1

SUSE-SU-2022_3532-1

SUSE-SU-2022_3533-1

SUSE-SU-2022_3596-1

USN-5641-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Squid

Squid Cache

Suse

Ubuntu

References · 51

• https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq · Patch
• https://bdu.fstec.ru/vul/2023-00066 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12364-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0351 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0131SE47MD · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3596-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41317 · Vendor Advisory
• https://openwall.com/lists/oss-security/2022/09/23/1 · Patch
• https://ubuntu.com/security/CVE-2022-41317 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3531-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41317 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2022-41317 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• http://squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch · Vendor Advisory