CVE-2020-11945

Katalog CVE

CVSS 9.8 · Critical EPSS 27,2%

Kerentanan Integer Overflow or Wraparound pada squid-cache squid, debian linux +3 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).

Rincian

Terbit di NVD

23 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

27,2% peluang dieksploitasi; lebih tinggi dari 98,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://master.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch advisory vendor
• http://www.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch patch · advisory vendor
• https://github.com/squid-cache/squid/commit/eeebf0f37a72a2de08348e85ae34b02c34e9a811 patch · advisory pihak ketiga
• https://github.com/squid-cache/squid/pull/585 patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/04/23/2 mailing list · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=1170313 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202005-05 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210304-0004/ advisory pihak ketiga
• https://usn.ubuntu.com/4356-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4682 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FWQRYZJPHAZB...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4MWXEZAJSOGR...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RV2VZWFJNO3B5...