CVE-2023-46728
Published: 6 November 2023
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.
Notes
Author | Note |
---|---|
rodrigo-zaiden | the fix is removing support for Gopher protocol. |
Priority
Status
Package | Release | Status |
---|---|---|
squid Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
focal |
Released
(4.10-1ubuntu1.8)
|
|
jammy |
Released
(5.7-0ubuntu0.22.04.2)
|
|
lunar |
Released
(5.7-1ubuntu3.1)
|
|
mantic |
Not vulnerable
(6.1-2ubuntu1)
|
|
trusty |
Ignored
(end of standard support)
|
|
upstream |
Released
(6.1-1)
|
|
xenial |
Ignored
(end of standard support)
|
|
Patches: upstream: https://github.com/squid-cache/squid/commit/6ea12e8fb590ac6959e9356a81aa3370576568c3 |
||
squid3 Launchpad, Ubuntu, Debian |
bionic |
Released
(3.5.27-1ubuntu1.14+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
lunar |
Does not exist
|
|
mantic |
Does not exist
|
|
trusty |
Ignored
(end of standard support)
|
|
upstream |
Needs triage
|
|
xenial |
Released
(3.5.12-1ubuntu7.16+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
- https://github.com/squid-cache/squid/security/advisories/GHSA-cg5h-v6vc-w33f
- https://megamansec.github.io/Squid-Security-Audit/gopher-nullpointer.html
- https://ubuntu.com/security/notices/USN-6500-1
- https://ubuntu.com/security/notices/USN-6500-2
- https://www.cve.org/CVERecord?id=CVE-2023-46728
- NVD
- Launchpad
- Debian