CVE - CVE-2024-23638

CVE-ID
CVE-2024-23638	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20240208-0010/ FEDORA:FEDORA-2024-a414a81d47 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ FEDORA:FEDORA-2024-bd8c6c6926 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ MISC:http://www.squid-cache.org/Versions/v5/SQUID-2023_11.patch URL:http://www.squid-cache.org/Versions/v5/SQUID-2023_11.patch MISC:http://www.squid-cache.org/Versions/v6/SQUID-2023_11.patch URL:http://www.squid-cache.org/Versions/v6/SQUID-2023_11.patch MISC:https://github.com/squid-cache/squid/commit/290ae202883ac28a48867079c2fb34c40efd382b URL:https://github.com/squid-cache/squid/commit/290ae202883ac28a48867079c2fb34c40efd382b MISC:https://github.com/squid-cache/squid/commit/e8118a7381213f5cfcdeb4cec1d2d854bfd261c8 URL:https://github.com/squid-cache/squid/commit/e8118a7381213f5cfcdeb4cec1d2d854bfd261c8 MISC:https://github.com/squid-cache/squid/security/advisories/GHSA-j49p-553x-48rx URL:https://github.com/squid-cache/squid/security/advisories/GHSA-j49p-553x-48rx MISC:https://megamansec.github.io/Squid-Security-Audit/stream-assert.html URL:https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240119	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240119)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)