Medium: squid

2019-03-1817:59:00

alas.aws.amazon.com

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.022 Low

EPSS

Percentile

89.3%

JSON

Issue Overview:

A memory leak was discovered in the way Squid handles SNMP denied queries. A remote attacker may use this flaw to exhaust the resources on the server machine. (CVE-2018-19132)

Affected Packages:

squid

Issue Correction:
Run yum update squid to update your system.

New Packages:

i686:  
    squid-3.5.20-12.38.amzn1.i686  
    squid-migration-script-3.5.20-12.38.amzn1.i686  
    squid-debuginfo-3.5.20-12.38.amzn1.i686  
  
src:  
    squid-3.5.20-12.38.amzn1.src  
  
x86_64:  
    squid-debuginfo-3.5.20-12.38.amzn1.x86_64  
    squid-3.5.20-12.38.amzn1.x86_64  
    squid-migration-script-3.5.20-12.38.amzn1.x86_64

Additional References

Red Hat: CVE-2018-19132

Mitre: CVE-2018-19132

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686squid< 3.5.20-12.38.amzn1squid-3.5.20-12.38.amzn1.i686.rpm
Amazon Linux1i686squid-migration-script< 3.5.20-12.38.amzn1squid-migration-script-3.5.20-12.38.amzn1.i686.rpm
Amazon Linux1i686squid-debuginfo< 3.5.20-12.38.amzn1squid-debuginfo-3.5.20-12.38.amzn1.i686.rpm
Amazon Linux1x86_64squid-debuginfo< 3.5.20-12.38.amzn1squid-debuginfo-3.5.20-12.38.amzn1.x86_64.rpm
Amazon Linux1x86_64squid< 3.5.20-12.38.amzn1squid-3.5.20-12.38.amzn1.x86_64.rpm
Amazon Linux1x86_64squid-migration-script< 3.5.20-12.38.amzn1squid-migration-script-3.5.20-12.38.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	squid	< 3.5.20-12.38.amzn1	squid-3.5.20-12.38.amzn1.i686.rpm
Amazon Linux	1	i686	squid-migration-script	< 3.5.20-12.38.amzn1	squid-migration-script-3.5.20-12.38.amzn1.i686.rpm
Amazon Linux	1	i686	squid-debuginfo	< 3.5.20-12.38.amzn1	squid-debuginfo-3.5.20-12.38.amzn1.i686.rpm
Amazon Linux	1	x86_64	squid-debuginfo	< 3.5.20-12.38.amzn1	squid-debuginfo-3.5.20-12.38.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	squid	< 3.5.20-12.38.amzn1	squid-3.5.20-12.38.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	squid-migration-script	< 3.5.20-12.38.amzn1	squid-migration-script-3.5.20-12.38.amzn1.x86_64.rpm