Lucene search

K
amazonAmazonALAS2-2023-1907
HistoryJan 18, 2023 - 12:16 a.m.

Important: squid

2023-01-1800:16:00
alas.aws.amazon.com
9

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

8.2 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.02 Low

EPSS

Percentile

88.6%

Issue Overview:

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. (CVE-2021-46784)

A flaw was found in Squid. An incorrect integer overflow protection in the Squid SSPI and SMB authentication helpers is vulnerable to a buffer overflow attack, resulting in information disclosure or a denial of service. (CVE-2022-41318)

Affected Packages:

squid

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update squid to update your system.

New Packages:

aarch64:  
    squid-3.5.20-17.amzn2.7.1.aarch64  
    squid-sysvinit-3.5.20-17.amzn2.7.1.aarch64  
    squid-migration-script-3.5.20-17.amzn2.7.1.aarch64  
    squid-debuginfo-3.5.20-17.amzn2.7.1.aarch64  
  
i686:  
    squid-3.5.20-17.amzn2.7.1.i686  
    squid-sysvinit-3.5.20-17.amzn2.7.1.i686  
    squid-migration-script-3.5.20-17.amzn2.7.1.i686  
    squid-debuginfo-3.5.20-17.amzn2.7.1.i686  
  
src:  
    squid-3.5.20-17.amzn2.7.1.src  
  
x86_64:  
    squid-3.5.20-17.amzn2.7.1.x86_64  
    squid-sysvinit-3.5.20-17.amzn2.7.1.x86_64  
    squid-migration-script-3.5.20-17.amzn2.7.1.x86_64  
    squid-debuginfo-3.5.20-17.amzn2.7.1.x86_64  

Additional References

Red Hat: CVE-2021-46784, CVE-2022-41318

Mitre: CVE-2021-46784, CVE-2022-41318

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

8.2 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.02 Low

EPSS

Percentile

88.6%