PT-2023-6825 · Squid+10 · Squid+11
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using
--with-opensslDescription
The issue is related to an Improper Validation of Specified Index bug in Squid, which allows a remote server to perform a Denial of Service attack against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump.
Recommendations
For Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4, update to Squid version 6.4 or apply patches from Squid's patch archives to fix the issue. If using a prepackaged version of Squid, refer to the package vendor for availability information on updated packages. As a temporary workaround, consider restricting access to HTTPS and SSL-Bump to minimize the risk of exploitation.
Exploit
Fix
DoS
Improper Certificate Validation
Improper Validation of Array Index
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Openssl
Red Hat
Red Os
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu