squid (5.7-1ubuntu3.1) lunar-security; urgency=medium
* SECURITY UPDATE: DoS against certificate validation
- debian/patches/CVE-2023-46724.patch: fix validation of certificates
with CN=* in src/anyp/Uri.cc.
- CVE-2023-46724
* SECURITY UPDATE: DoS via Gopher gateway
- debian/patches/CVE-2023-46728.patch: disable gopher support in
src/FwdState.cc, src/HttpRequest.cc, src/IoStats.h, src/Makefile.am,
src/adaptation/ecap/Host.cc, src/adaptation/ecap/MessageRep.cc,
src/anyp/ProtocolType.h, src/anyp/Uri.cc, src/anyp/UriScheme.cc,
src/client_side_request.cc, src/error/forward.h, src/http/Message.h,
src/mgr/IoAction.cc, src/mgr/IoAction.h, src/stat.cc,
src/tests/Stub.am.
- CVE-2023-46728
* SECURITY UPDATE: HTTP request smuggling, caused by chunked decoder
lenience
- debian/patches/CVE-2023-46846.patch: improve HTTP chunked encoding
compliance in src/http/one/Parser.cc, src/http/one/Parser.h,
src/http/one/TeChunkedParser.cc, src/parser/Tokenizer.cc,
src/parser/Tokenizer.h.
- CVE-2023-46846
* SECURITY UPDATE: DoS via HTTP Digest Authentication
- debian/patches/CVE-2023-46847.patch: fix stack buffer overflow when
parsing Digest Authorization in src/auth/digest/Config.cc.
- CVE-2023-46847
* SECURITY UPDATE: DoS via ftp:// URLs
- debian/patches/CVE-2023-46848.patch: fix userinfo percent-encoding in
src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc,
src/anyp/Uri.cc.
- CVE-2023-46848
-- Marc Deslauriers <email address hidden> Mon, 13 Nov 2023 08:48:55 -0500
|
CVE-2023-46724 |
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 |
CVE-2023-46728 |
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of |
CVE-2023-46846 |
SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling pas |
CVE-2023-46847 |
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to he |
CVE-2023-46848 |
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ft |
|