CVE-2024-23638

squid-cache squid

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-23638

Katalog CVE

CVSS 6.5 · Medium EPSS 60,1%

Kerentanan Expired Pointer Dereference pada squid-cache squid. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.

Rincian

Terbit di NVD
24 Januari 2024
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-825: Expired Pointer Dereference
CWE-672: Operation on a Resource after Expiration or Release
EPSS (30 hari)
60,1% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
squid-cache squid Versi 5.0 hingga 5.9
squid-cache squid Versi 6.0 hingga sebelum 6.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.