CVE-2023-46724

squid-cache squid

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-46724

Katalog CVE

CVSS 7.5 · High EPSS 4,0%

Kerentanan Out-of-bounds Read pada squid-cache squid. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.

Rincian

Terbit di NVD
1 November 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-125: Out-of-bounds Read
CWE-129: Improper Validation of Array Index
CWE-786: Access of Memory Location Before Start of Buffer
CWE-823: Use of Out-of-range Pointer Offset
CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
CWE-295: Improper Certificate Validation
EPSS (30 hari)
4,0% peluang dieksploitasi; lebih tinggi dari 90,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
squid-cache squid Versi 3.3.0.1 hingga sebelum 6.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.