CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 4CVE-2015-5400
https://notcve.org/view.php?id=CVE-2015-5400
Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request. Vulnerabilidad en Squid en versiones anteriores a 3.5.6, no maneja adecuadamente las respuestas de pares del método CONNECT cuando se configura con cache_peer, lo que permite a atacantes remotos eludir las restricciones previstas y obtener acceso a un proxy backend a través de una solicitud CONNECT. • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html http://www.debian.org/security/2015/dsa-3327 http://www.openwall.com/lists/oss-security/2015/07/06/8 http://www.openwall.com/lists/oss-security/2015/07/09/12 http://www.openwall.com/lists&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.8EPSS: 1%CPEs: 73EXPL: 0CVE-2015-3455 – squid: incorrect X509 server certificate validation (SQUID-2015:1)
https://notcve.org/view.php?id=CVE-2015-3455
Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate. Squid 3.2.x en versiones anteriores a 3.2.14, 3.3.x en versiones anteriores a 3.3.14, 3.4.x en versiones anteriores a 3.4.13 y 3.5.x en versiones anteriores a 3.5.4, cuando el primer cliente está configurado mediante SSL-bump, no valida adecuadamente el dominio o campos de nombre de host de certificados X.509, lo que permite a atacantes man-in-the-middle suplantar servidores SSL a través de un certificado válido. It was found that Squid configured with client-first SSL-bump did not correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a Squid server using a specially crafted X.509 certificate. • http://advisories.mageia.org/MGASA-2015-0191.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00016.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html http://rhn.redhat.com/errata/RHSA-2015-2378.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:230 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security&# • CWE-20: Improper Input Validation CWE-297: Improper Validation of Certificate with Host Mismatch •