CVE-2021-41611: squid-cache squid +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-41611

CVSS 7.5 · High EPSS 2,9%

Kerentanan Improper Certificate Validation pada squid-cache squid, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.

Rincian

Terbit di NVD: 18 Oktober 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-295: Improper Certificate Validation
EPSS (30 hari): 2,9% peluang dieksploitasi; lebih tinggi dari 86,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
squid-cache	squid	Versi 5.0.6 hingga sebelum 5.2
fedoraproject	fedora	Versi 35

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.squid-cache.org/Versions/v6/changesets/squid-6-43d6b5c81b88ec2256b430c69a872a1e4f324e4a.patch advisory vendor
https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r patch · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2021/12/23/2 mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CWQ2WKDWTSO47...

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.