squid: weak certificate validation

🗓️ 01 May 2015 00:00:00Reported by Arch LinuxType

archlinux

archlinux🔗 lists.archlinux.org👁 33 Views

weak certificate validation in Squid with bypass vulnerabilit

Reporter	Title	Published	Views	Family All 45
Tenable Nessus	Squid 3.2.x < 3.2.14 / 3.3.x < 3.3.14 / 3.4.x < 3.4.13 / 3.5.x < 3.5.4 X.509 Certificate Validation Vulnerability	16 Sep 201500:00	–	nessus
Tenable Nessus	CentOS 7 : squid (CESA-2015:2378)	2 Dec 201500:00	–	nessus
Tenable Nessus	Fedora 22 : libecap-1.0.0-1.fc22 / squid-3.5.10-1.fc22 (2016-7b40eb9e29)	9 May 201600:00	–	nessus
Tenable Nessus	FreeBSD : squid -- client-first SSL-bump does not correctly validate X509 server certificate (b6da24da-23f7-11e5-a4a5-002590263bf5)	7 Jul 201500:00	–	nessus
Tenable Nessus	Mandriva Linux Security Advisory : squid (MDVSA-2015:230)	7 May 201500:00	–	nessus
Tenable Nessus	MiracleLinux 7 : squid-3.3.8-26.el7 (AXSA:2015-755:01)	16 Jan 202600:00	–	nessus
Tenable Nessus	openSUSE Security Update : squid (openSUSE-2015-581)	14 Sep 201500:00	–	nessus
Tenable Nessus	openSUSE Security Update : squid (openSUSE-2016-988)	17 Aug 201600:00	–	nessus
Tenable Nessus	Oracle Linux 7 : squid (ELSA-2015-2378)	24 Nov 201500:00	–	nessus
Tenable Nessus	RHEL 7 : squid (RHSA-2015:2378)	20 Nov 201500:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
any	any	any	squid	3.5.4-1	UNKNOWN

Source	Link
squid-cache	www.squid-cache.org/Advisories/SQUID-2015_1.txt
openwall	www.openwall.com/lists/oss-security/2015/04/30/2
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

01 May 2015 00:00Current

3.8Low risk

Vulners AI Score3.8

EPSS0.06474

squid certificate validation bypass vulnerability ssl-bump unix