CVE-2023-49286

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3.0 7.5 HIGH

7.5^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27	Vendor Advisory
https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264	Patch
http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch	Broken Link
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Information

Published : 2023-12-04 23:15

Updated : 2024-01-09 02:15

NVD link : CVE-2023-49286

Mitre link : CVE-2023-49286

JSON object : View

Products Affected

squid-cache

squid

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

CWE-617

Reachable Assertion

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27", "name": "https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264", "name": "https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264", "tags": ["Patch"], "refsource": ""}, {"url": "http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch", "name": "http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch", "tags": ["Broken Link"], "refsource": ""}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/", "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/", "tags": [], "refsource": ""}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/", "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/", "tags": [], "refsource": ""}, {"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html", "name": "https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html", "tags": [], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-754"}, {"lang": "en", "value": "CWE-617"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-49286", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2023-12-04T23:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.4"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2024-01-09T02:15Z"}