rpm package
suse/squid&distro=SUSE OpenStack Cloud 9
pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%209
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-41318 | — | < 3.5.21-26.38.1 | 3.5.21-26.38.1 | Dec 25, 2022 | A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locatio | ||
| CVE-2022-41317 | — | < 3.5.21-26.38.1 | 3.5.21-26.38.1 | Dec 25, 2022 | An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7. | ||
| CVE-2021-46784 | — | < 3.5.21-26.35.1 | 3.5.21-26.35.1 | Jul 17, 2022 | In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. | ||
| CVE-2021-28651 | — | < 3.5.21-26.35.1 | 3.5.21-26.35.1 | May 27, 2021 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can | ||
| CVE-2020-25097 | — | < 3.5.21-26.35.1 | 3.5.21-26.35.1 | Mar 19, 2021 | An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configurati | ||
| CVE-2020-15811 | — | < 3.5.21-26.32.1 | 3.5.21-26.32.1 | Sep 2, 2020 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local securi | ||
| CVE-2020-15810 | — | < 3.5.21-26.32.1 | 3.5.21-26.32.1 | Sep 2, 2020 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local securi | ||
| CVE-2020-24606 | — | < 3.5.21-26.32.1 | 3.5.21-26.32.1 | Aug 24, 2020 | Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists | ||
| CVE-2020-15049 | — | < 3.5.21-26.29.1 | 3.5.21-26.29.1 | Jun 30, 2020 | An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shel |
- CVE-2022-41318Dec 25, 2022affected < 3.5.21-26.38.1fixed 3.5.21-26.38.1
A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locatio
- CVE-2022-41317Dec 25, 2022affected < 3.5.21-26.38.1fixed 3.5.21-26.38.1
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- CVE-2021-46784Jul 17, 2022affected < 3.5.21-26.35.1fixed 3.5.21-26.35.1
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
- CVE-2021-28651May 27, 2021affected < 3.5.21-26.35.1fixed 3.5.21-26.35.1
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can
- CVE-2020-25097Mar 19, 2021affected < 3.5.21-26.35.1fixed 3.5.21-26.35.1
An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configurati
- CVE-2020-15811Sep 2, 2020affected < 3.5.21-26.32.1fixed 3.5.21-26.32.1
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local securi
- CVE-2020-15810Sep 2, 2020affected < 3.5.21-26.32.1fixed 3.5.21-26.32.1
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local securi
- CVE-2020-24606Aug 24, 2020affected < 3.5.21-26.32.1fixed 3.5.21-26.32.1
Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists
- CVE-2020-15049Jun 30, 2020affected < 3.5.21-26.29.1fixed 3.5.21-26.29.1
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shel