Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.
History

Sat, 09 Nov 2024 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Tue, 15 Oct 2024 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-12-04T22:49:31.317Z

Updated: 2024-10-15T17:38:43.439Z

Reserved: 2023-11-24T16:45:24.312Z

Link: CVE-2023-49288

cve-icon Vulnrichment

Updated: 2024-08-02T21:53:44.876Z

cve-icon NVD

Status : Modified

Published: 2023-12-04T23:15:27.477

Modified: 2024-01-19T16:15:09.930

Link: CVE-2023-49288

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-12-05T00:00:00Z

Links: CVE-2023-49288 - Bugzilla