USN-6728-1: Squid vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• squid - Web proxy cache server

Details

Joshua Rogers discovered that Squid incorrectly handled collapsed
forwarding. A remote attacker could possibly use this issue to cause Squid
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)

Joshua Rogers discovered that Squid incorrectly handled certain structural
elements. A remote attacker could possibly use this issue to cause Squid to
crash, resulting in a denial of service. (CVE-2023-5824)

Joshua Rogers discovered that Squid incorrectly handled Cache Manager error
responses. A remote trusted client can possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2024-23638)

Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked
decoder. A remote attacker could possibly use this issue to cause Squid to
stop responding, resulting in a denial of service. (CVE-2024-25111)

Joshua Rogers discovered that Squid incorrectly handled HTTP header
parsing. A remote trusted client can possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2024-25617)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• squid - 6.1-2ubuntu1.3

Ubuntu 22.04

• squid - 5.7-0ubuntu0.22.04.4

Ubuntu 20.04

• squid - 4.10-1ubuntu1.10

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-23638
• CVE-2023-5824
• CVE-2024-25617
• CVE-2024-25111
• CVE-2023-49288

Related notices

• USN-6728-3: squidclient, squid-common, squid, squid-cgi, squid-purge
• USN-6857-1: squidclient, squid-common, squid, squid3, squid-cgi, squid-purge