CVE-2023-46728
Summary
| CVE | CVE-2023-46728 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-11-06 18:15:00 UTC |
|---|
| Updated | 2023-11-14 20:00:00 UTC |
|---|
| Description | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Squid-cache |
Squid |
All |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Remove support for Gopher protocol (#1092) · squid-cache/squid@6ea12e8 · GitHub |
MISC |
github.com |
|
| SQUID-2021:8 Denial of Service in Gopher gateway · Advisory · squid-cache/squid · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161268 Oracle Enterprise Linux Security Update for squid:4 (ELSA-2024-0046)
- 161269 Oracle Enterprise Linux Security Update for squid (ELSA-2024-0071)
- 161480 Oracle Enterprise Linux Security Update for squid (ELSA-2024-1787)
- 199932 Ubuntu Security Notification for Squid Vulnerabilities (USN-6500-1)
- 199990 Ubuntu Security Notification for Squid Vulnerabilities (USN-6500-2)
- 242863 Red Hat Update for squid:4 (RHSA-2024:0397)
- 242910 Red Hat Update for squid (RHSA-2024:0072)
- 242913 Red Hat Update for squid:4 (RHSA-2024:0773)
- 242914 Red Hat Update for squid:4 (RHSA-2024:0771)
- 242915 Red Hat Update for squid:4 (RHSA-2024:0772)
- 243018 Red Hat Update for squid (RHSA-2024:1153)
- 243194 Red Hat Update for squid (RHSA-2024:1787)
- 284838 Fedora Security Update for squid (FEDORA-2023-6317eaa767)
- 285079 Fedora Security Update for squid (FEDORA-2023-ab77331a34)
- 296108 Oracle Solaris 11.4 Support Repository Update (SRU) 66.164.1 Missing (CPUJAN2024)
- 356742 Amazon Linux Security Advisory for squid : ALAS-2023-1885
- 356755 Amazon Linux Security Advisory for squid : ALAS2-2023-2354
- 356900 Amazon Linux Security Advisory for squid : ALAS2023-2023-429
- 356995 Amazon Linux Security Advisory for squid : AL2012-2023-479
- 379621 Alibaba Cloud Linux Security Update for squid:4 (ALINUX3-SA-2024:0020)
- 6000513 Debian Security Update for squid (DSA 5637-1)
- 673768 EulerOS Security Update for squid (EulerOS-SA-2024-1301)
- 755328 SUSE Enterprise Linux Security Update for squid (SUSE-SU-2023:4545-1)
- 755329 SUSE Enterprise Linux Security Update for squid (SUSE-SU-2023:4544-1)
- 755352 SUSE Enterprise Linux Security Update for squid (SUSE-SU-2023:4589-1)
