[SECURITY] [DSA 5258-1] squid security update

2022-10-1908:18:22

lists.debian.org

squid

security update

cve-2022-41317

cve-2022-41318

debian bullseye

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

42.3%

JSON

Debian Security Advisory DSA-5258-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
October 19, 2022 https://www.debian.org/security/faq

Package : squid
CVE ID : CVE-2022-41317 CVE-2022-41318
Debian Bug : 1020586 1020587

Several vulnerabilities were discovered in Squid, a fully featured web
proxy cache, which could result in exposure of sensitive information in
the cache manager (CVE-2022-41317), or denial of service or information
disclosure if Squid is configured to negotiate authentication with the
SSPI and SMB authentication helpers (CVE-2022-41318).

For the stable distribution (bullseye), these problems have been fixed in
version 4.13-10+deb11u2.

We recommend that you upgrade your squid packages.

For the detailed security status of squid please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/squid

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian11s390xsquid-purge< 4.13-10+deb11u2squid-purge_4.13-10+deb11u2_s390x.deb
Debian11armelsquid-cgi< 4.13-10+deb11u2squid-cgi_4.13-10+deb11u2_armel.deb
Debian11mipselsquid-openssl< 4.13-10+deb11u2squid-openssl_4.13-10+deb11u2_mipsel.deb
Debian11amd64squid< 4.13-10+deb11u2squid_4.13-10+deb11u2_amd64.deb
Debian10armhfsquid-purge< 4.6-1+deb10u8squid-purge_4.6-1+deb10u8_armhf.deb
Debian11mips64elsquid< 4.13-10+deb11u2squid_4.13-10+deb11u2_mips64el.deb
Debian11ppc64elsquidclient< 4.13-10+deb11u2squidclient_4.13-10+deb11u2_ppc64el.deb
Debian11armelsquid-openssl< 4.13-10+deb11u2squid-openssl_4.13-10+deb11u2_armel.deb
Debian11amd64squid-purge< 4.13-10+deb11u2squid-purge_4.13-10+deb11u2_amd64.deb
Debian11armhfsquid-dbgsym< 4.13-10+deb11u2squid-dbgsym_4.13-10+deb11u2_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	s390x	squid-purge	< 4.13-10+deb11u2	squid-purge_4.13-10+deb11u2_s390x.deb
Debian	11	armel	squid-cgi	< 4.13-10+deb11u2	squid-cgi_4.13-10+deb11u2_armel.deb
Debian	11	mipsel	squid-openssl	< 4.13-10+deb11u2	squid-openssl_4.13-10+deb11u2_mipsel.deb
Debian	11	amd64	squid	< 4.13-10+deb11u2	squid_4.13-10+deb11u2_amd64.deb
Debian	10	armhf	squid-purge	< 4.6-1+deb10u8	squid-purge_4.6-1+deb10u8_armhf.deb
Debian	11	mips64el	squid	< 4.13-10+deb11u2	squid_4.13-10+deb11u2_mips64el.deb
Debian	11	ppc64el	squidclient	< 4.13-10+deb11u2	squidclient_4.13-10+deb11u2_ppc64el.deb
Debian	11	armel	squid-openssl	< 4.13-10+deb11u2	squid-openssl_4.13-10+deb11u2_armel.deb
Debian	11	amd64	squid-purge	< 4.13-10+deb11u2	squid-purge_4.13-10+deb11u2_amd64.deb
Debian	11	armhf	squid-dbgsym	< 4.13-10+deb11u2	squid-dbgsym_4.13-10+deb11u2_armhf.deb