PT-2024-7480 · Squid+7 · Squid+8
Megamansec
·
Published
2024-10-28
·
Updated
2025-03-17
·
CVE-2024-45802
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Squid versions prior to 6.10
Description:
The issue is related to errors in processing input data, which can be exploited by a remote attacker to cause a denial of service by sending specially crafted ESI packets. This is due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs. The vulnerability allows a trusted server to launch Denial of Service attacks against all clients using the proxy.
Recommendations:
For versions prior to 6.10, update to Squid version 6.10 or later, which includes the fix for this issue in its default build configuration. As a temporary workaround, consider restricting access to the proxy server to minimize the risk of exploitation.
Exploit
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Red Hat
Red Os
Rocky Linux
Squid
Squid Cache