Veracode Vulnerability DatabaseVERACODE:44107Denial Of Service
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
6.8 Medium
AI Score
Confidence
High
0.006 Low
EPSS
Percentile
78.7%
Squid is vulnerable to Denial Of Service. The vulnerability is due to improper validation of particular index which allows an attacker to initiate a TLS Handshake with a malicious crafted SSL Certificate in a server certificate chain thus leading to denial of service.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libsquid.so | eq | 1.0.0 | |
| squid:sid | eq | 4.13-6 | |
| squid:sid | eq | 4.13-1 | |
| libsquid.so | eq | 1.0.0 | |
| squid:sid | eq | 4.13-6 | |
| squid:sid | eq | 4.13-1 | |
| squid:edge | eq | 5.1-r0 | |
| squid:edge | eq | 6.3-r0 | |
| squid:edge | eq | 5.6-r0 | |
| squid:edge | eq | 5.9-r1 |
References
www.squid-cache.org/Versions/v5/SQUID-2023_4.patch
www.squid-cache.org/Versions/v6/SQUID-2023_4.patch
github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810
github.com/squid-cache/squid/security/advisories/GHSA-73m6-jm96-c6r3
lists.fedoraproject.org/archives/list/[email protected]/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
lists.fedoraproject.org/archives/list/[email protected]/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
security.netapp.com/advisory/ntap-20231208-0001/
Related
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
6.8 Medium
AI Score
Confidence
High
0.006 Low
EPSS
Percentile
78.7%