CVE-2015-5400

EUVD-2015-5356
Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
debiandebian_linux
7.0
debiandebian_linux
8.0
squid-cachesquid
𝑥
≤ 3.5.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
squid
bookworm
5.7-2+deb12u2
fixed
bookworm (security)
5.7-2+deb12u2
fixed
bullseye
4.13-10+deb11u3
fixed
bullseye (security)
4.13-10+deb11u3
fixed
sid
6.12-1
fixed
squeeze
no-dsa
trixie
6.12-1
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
squid3
precise
ignored
trusty
dne
utopic
ignored
vivid
ignored
wily
ignored
xenial
Fixed 3.5.12-1ubuntu6
released
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
http://www.debian.org/security/2015/dsa-3327
http://www.openwall.com/lists/oss-security/2015/07/06/8
http://www.openwall.com/lists/oss-security/2015/07/09/12
http://www.openwall.com/lists/oss-security/2015/07/10/2
http://www.openwall.com/lists/oss-security/2015/07/17/14
http://www.securityfocus.com/bid/75553
http://www.securitytracker.com/id/1032873
http://www.squid-cache.org/Advisories/SQUID-2015_2.txt
http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10494.patch
http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13225.patch
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.patch
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
http://www.debian.org/security/2015/dsa-3327
http://www.openwall.com/lists/oss-security/2015/07/06/8
http://www.openwall.com/lists/oss-security/2015/07/09/12
http://www.openwall.com/lists/oss-security/2015/07/10/2
http://www.openwall.com/lists/oss-security/2015/07/17/14
http://www.securityfocus.com/bid/75553
http://www.securitytracker.com/id/1032873
http://www.squid-cache.org/Advisories/SQUID-2015_2.txt
http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10494.patch
http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13225.patch
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.patch