CVE-2023-49288
Published: 4 December 2023
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.
Notes
| Author | Note |
|---|---|
| mdeslaur | need to identify commit in 6.0.1...perhaps this one? https://github.com/squid-cache/squid/commit/836d3c0b158f6e7bc795d1e6d881c873d98728e8 or https://github.com/squid-cache/squid/commit/9358e99f998ace9c4c7a21d510432dde5b7f9cca While this is fixed by a yet unidentified commit in 6.0.1, I believe it is also fixed in a different way by the refactoring in the commit to fix CVE-2023-5824. The issue no longer reproduces with the fix for CVE-2023-5824 applied. Ubuntu 20.04 LTS was patched in USN-6728-1, but the fix introduced crashes and was backed out in USN-6728-2. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
squid Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
| focal |
Released
(4.10-1ubuntu1.12)
|
|
| jammy |
Released
(5.7-0ubuntu0.22.04.4)
|
|
| lunar |
Ignored
(end of life, was deferred [2024-01-26])
|
|
| mantic |
Not vulnerable
(6.1-2ubuntu1.1)
|
|
| noble |
Not vulnerable
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Released
(6.1-1)
|
|
| xenial |
Ignored
(end of standard support)
|
|
|
squid3 Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Needs triage
|
|
| xenial |
Needed
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
- https://github.com/squid-cache/squid/security/advisories/GHSA-rj5h-46j6-q2g5
- https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
- https://ubuntu.com/security/notices/USN-6728-1
- https://ubuntu.com/security/notices/USN-6728-2
- https://www.cve.org/CVERecord?id=CVE-2023-49288
- https://ubuntu.com/security/notices/USN-6728-3
- NVD
- Launchpad
- Debian