CVE-2020-24606

Katalog CVE

CVSS 7.5 · High EPSS 5,0%

Kerentanan Improper Locking pada squid-cache squid, canonical ubuntu linux +3 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.

Rincian

Terbit di NVD

24 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-667: Improper Locking

EPSS (30 hari)

5,0% peluang dieksploitasi; lebih tinggi dari 92,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patch patch · advisory vendor
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html mailing list · advisory pihak ketiga
• https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210219-0007/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210226-0006/ advisory pihak ketiga
• https://usn.ubuntu.com/4477-1/ advisory pihak ketiga
• https://usn.ubuntu.com/4551-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4751 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLV...
• https://security.netapp.com/advisory/ntap-20210226-0007/ broken link