rpm package
suse/squid&distro=SUSE Enterprise Storage 7
pkg:rpm/suse/squid&distro=SUSE%20Enterprise%20Storage%207
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-41318 | — | < 4.17-150000.5.35.1 | 4.17-150000.5.35.1 | Dec 25, 2022 | A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locatio | ||
| CVE-2022-41317 | — | < 4.17-150000.5.35.1 | 4.17-150000.5.35.1 | Dec 25, 2022 | An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7. | ||
| CVE-2021-46784 | — | < 4.17-150000.5.32.1 | 4.17-150000.5.32.1 | Jul 17, 2022 | In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. | ||
| CVE-2021-33620 | — | < 4.17-150000.5.32.1 | 4.17-150000.5.32.1 | May 28, 2021 | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server. |
- CVE-2022-41318Dec 25, 2022affected < 4.17-150000.5.35.1fixed 4.17-150000.5.35.1
A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locatio
- CVE-2022-41317Dec 25, 2022affected < 4.17-150000.5.35.1fixed 4.17-150000.5.35.1
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- CVE-2021-46784Jul 17, 2022affected < 4.17-150000.5.32.1fixed 4.17-150000.5.32.1
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
- CVE-2021-33620May 28, 2021affected < 4.17-150000.5.32.1fixed 4.17-150000.5.32.1
Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.