CVE-2023-49288

CVSS V2 None CVSS V3 None
Description
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.
Overview
  • CVE ID
  • CVE-2023-49288
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-12-04T22:49:31.317Z
  • Last Modified Date
  • 2023-12-04T22:49:31.317Z
Weakness Enumerations
CWE URL
CWE-416 http://cwe.mitre.org/data/definitions/416.html
References
Reference URL Reference Tags
https://github.com/squid-cache/squid/security/advisories/GHSA-rj5h-46j6-q2g5 x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
https://security.netapp.com/advisory/ntap-20240119-0006/
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-49288
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49288
History
Created Old Value New Value Data Type Notes
2024-06-25 13:16:36 Added to TrackCVE