CVE-2020-8517

Katalog CVE

CVSS 7.5 · High EPSS 6,8%

Kerentanan Improper Input Validation pada squid-cache squid, opensuse leap +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.

Rincian

Terbit di NVD

4 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-787: Out-of-bounds Write

EPSS (30 hari)

6,8% peluang dieksploitasi; lebih tinggi dari 93,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.squid-cache.org/Advisories/SQUID-2020_3.txt advisory vendor
• http://www.squid-cache.org/Versions/v4/changesets/squid-4-6982f1187a26557e582172965e266f544ea562a5.patch patch · advisory vendor
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202003-34 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210304-0002/ advisory pihak ketiga
• https://usn.ubuntu.com/4289-1/ advisory pihak ketiga