CVE-2023-49286
Published: 4 December 2023
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
squid Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
| focal |
Released
(4.10-1ubuntu1.9)
|
|
| jammy |
Released
(5.7-0ubuntu0.22.04.3)
|
|
| lunar |
Released
(5.7-1ubuntu3.2)
|
|
| mantic |
Released
(6.1-2ubuntu1.2)
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Released
(6.5-1)
|
|
| xenial |
Ignored
(end of standard support)
|
|
|
Patches: upstream: https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264 upstream: http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch |
||
|
squid3 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Needs triage
|
|
| xenial |
Needs triage
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |