SB2024062519 - Denial of service in Squid

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2024-37894)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing ESI response content. A remote attacker can trick the victim to visit a specially crafted website, trigger an out-of-bounds write and crash the proxy server.

2) Resource management error (CVE-ID: CVE-2024-45802)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing ESI response content. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability requires that Squid is acting as reverse proxy where ESI feature has been enabled at build time.

Remediation

Install update from vendor's website.

References

• https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg
• https://github.com/squid-cache/squid/security/advisories/GHSA-f975-v7qw-q7hj