Description (CNA)
SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 2.6 before 6.4 |
| Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Support | unaffected 7:3.5.20-17.el7_9.13 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 8080020231030214932.63b34585 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 8090020231030224841.a75119d5 before * |
| Red Hat / Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | unaffected 8010020231101141358.c27ad7f8 before * |
| Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Support | unaffected 8020020231101135052.4cda2c84 before * |
| Red Hat / Red Hat Enterprise Linux 8.2 Telecommunications Update Service | unaffected 8020020231101135052.4cda2c84 before * |
| Red Hat / Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | unaffected 8020020231101135052.4cda2c84 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 8040020231101101624.522a0ee4 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Telecommunications Update Service | unaffected 8040020231101101624.522a0ee4 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | unaffected 8040020231101101624.522a0ee4 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support | unaffected 8060020231031165747.ad008a3a before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 7:5.5-5.el9_2.1 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 7:5.5-6.el9_3.1 before * |
| Red Hat / Red Hat Enterprise Linux 9.0 Extended Update Support | unaffected 7:5.2-1.el9_0.3 before * |
| Red Hat / Red Hat Enterprise Linux 6 | affected |
| Red Hat / Red Hat Enterprise Linux 6 | affected |
CWE
CWE-444
References
- https://access.redhat.com/errata/RHSA-2023:6266
- https://access.redhat.com/errata/RHSA-2023:6267
- https://access.redhat.com/errata/RHSA-2023:6268
- https://access.redhat.com/errata/RHSA-2023:6748
- https://access.redhat.com/errata/RHSA-2023:6801
- https://access.redhat.com/errata/RHSA-2023:6803
- https://access.redhat.com/errata/RHSA-2023:6804
- https://access.redhat.com/errata/RHSA-2023:6810
- https://access.redhat.com/errata/RHSA-2023:7213
- https://access.redhat.com/errata/RHSA-2024:11049
- https://access.redhat.com/security/cve/CVE-2023-46846
- https://bugzilla.redhat.com/show_bug.cgi?id=2245910
- https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
ADP enrichment
No English description supplied.
- https://access.redhat.com/errata/RHSA-2023:6266
- https://access.redhat.com/errata/RHSA-2023:6267
- https://access.redhat.com/errata/RHSA-2023:6268
- https://access.redhat.com/errata/RHSA-2023:6748
- https://access.redhat.com/errata/RHSA-2023:6801
- https://access.redhat.com/errata/RHSA-2023:6803
- https://access.redhat.com/errata/RHSA-2023:6804
- https://access.redhat.com/errata/RHSA-2023:6810
- https://access.redhat.com/errata/RHSA-2023:7213
- https://access.redhat.com/security/cve/CVE-2023-46846
- https://bugzilla.redhat.com/show_bug.cgi?id=2245910
- https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
- https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20231130-0002/
No English description supplied.
No references supplied.