CVE-2023-49288

Squid es un proxy de almacenamiento en caché para la Web que admite HTTP, HTTPS, FTP y más. Las versiones afectadas de squid están sujetas a un error Use-After-Free que puede provocar un ataque de denegación de servicio mediante reenvío colapsado. Todas las versiones de Squid desde la 3.5 hasta la 5.9 inclusive configuradas con "collapsed_forwarding on" son vulnerables. Las configuraciones con "collapsed_forwarding desactivado" o sin una directiva "collapsed_forwarding" no son vulnerables. Este error se solucionó con la versión 6.0.1 de Squid. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben eliminar todas las líneas collapsed_forwarding de su squid.conf.

A flaw was found in Squid. The use of the HTTP Collapsed Forwarding configuration may allow an attacker to perform a denial of service remotely.

USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused Squid to crash in certain environments on Ubuntu 20.04 LTS. The problematic fix has been reverted pending further investigation. Joshua Rogers discovered that Squid incorrectly handled collapsed forwarding. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. Joshua Rogers discovered that Squid incorrectly handled certain structural elements. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. Joshua Rogers discovered that Squid incorrectly handled Cache Manager error responses. A remote trusted client can possibly use this issue to cause Squid to crash, resulting in a denial of service. Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked decoder. A remote attacker could possibly use this issue to cause Squid to stop responding, resulting in a denial of service. Joshua Rogers discovered that Squid incorrectly handled HTTP header parsing. A remote trusted client can possibly use this issue to cause Squid to crash, resulting in a denial of service.