Important: squid

Issue Overview:

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. (CVE-2021-46784)

A flaw was found in Squid. An incorrect integer overflow protection in the Squid SSPI and SMB authentication helpers is vulnerable to a buffer overflow attack, resulting in information disclosure or a denial of service. (CVE-2022-41318)

Affected Packages:

squid

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update squid to update your system.

New Packages:

aarch64:  
    squid-3.5.20-17.amzn2.7.1.aarch64  
    squid-sysvinit-3.5.20-17.amzn2.7.1.aarch64  
    squid-migration-script-3.5.20-17.amzn2.7.1.aarch64  
    squid-debuginfo-3.5.20-17.amzn2.7.1.aarch64  
  
i686:  
    squid-3.5.20-17.amzn2.7.1.i686  
    squid-sysvinit-3.5.20-17.amzn2.7.1.i686  
    squid-migration-script-3.5.20-17.amzn2.7.1.i686  
    squid-debuginfo-3.5.20-17.amzn2.7.1.i686  
  
src:  
    squid-3.5.20-17.amzn2.7.1.src  
  
x86_64:  
    squid-3.5.20-17.amzn2.7.1.x86_64  
    squid-sysvinit-3.5.20-17.amzn2.7.1.x86_64  
    squid-migration-script-3.5.20-17.amzn2.7.1.x86_64  
    squid-debuginfo-3.5.20-17.amzn2.7.1.x86_64  

Additional References

Red Hat: CVE-2021-46784, CVE-2022-41318

Mitre: CVE-2021-46784, CVE-2022-41318