CVE-2005-0241

2005-05-0204:00:00

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.965 High

EPSS

Percentile

99.6%

JSON

The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling “oversized” HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.

OSVersionArchitecturePackageVersionFilename
Debian12allsquid< 2.5.7-7squid_2.5.7-7_all.deb
Debian11allsquid< 2.5.7-7squid_2.5.7-7_all.deb
Debian10allsquid< 2.5.7-7squid_2.5.7-7_all.deb
Debian999allsquid< 2.5.7-7squid_2.5.7-7_all.deb
Debian13allsquid< 2.5.7-7squid_2.5.7-7_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	squid	< 2.5.7-7	squid_2.5.7-7_all.deb
Debian	11	all	squid	< 2.5.7-7	squid_2.5.7-7_all.deb
Debian	10	all	squid	< 2.5.7-7	squid_2.5.7-7_all.deb
Debian	999	all	squid	< 2.5.7-7	squid_2.5.7-7_all.deb
Debian	13	all	squid	< 2.5.7-7	squid_2.5.7-7_all.deb