CVE-2022-41318

CVSS V2 None CVSS V3 None
Description
A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.
Overview
  • CVE ID
  • CVE-2022-41318
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-12-25T19:15:10
  • Last Modified Date
  • 2023-03-28T18:04:31
Weakness Enumerations
CWE URL
CWE-125 http://cwe.mitre.org/data/definitions/125.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* 1 OR 2.5 5.7
References
Reference URL Reference Tags
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_2.patch
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_2.patch
https://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78
https://www.openwall.com/lists/oss-security/2022/09/23/2
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-41318
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41318
History
Created Old Value New Value Data Type Notes
2022-12-25 19:16:06 Added to TrackCVE
2022-12-27 14:15:42 2022-12-27T13:48:11 CVE Modified Date updated
2022-12-27 14:15:42 Received Awaiting Analysis Vulnerability Status updated
2022-12-30 13:14:32 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2023-01-05 03:15:31 2023-01-05T02:17:38 CVE Modified Date updated
2023-01-05 03:15:31 Undergoing Analysis Analyzed Vulnerability Status updated
2023-01-05 03:15:31 Weakness Enumeration new
2023-01-05 03:15:32 CPE Information updated
2023-03-28 18:13:48 2023-03-28T18:04:31 CVE Modified Date updated