CVE-2023-50269

14.12.2023, 18:15

Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
GitHub_M	CNA	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 80%

Vendor	Product	Version
squid-cache	squid	3.1 ≤ 𝑥 ≤ 5.9
squid-cache	squid	6.0.1 ≤ 𝑥 ≤ 6.5
squid-cache	squid	2.6
squid-cache	squid	2.7
squid-cache	squid	2.7:stable1
squid-cache	squid	2.7:stable2
squid-cache	squid	2.7:stable3
squid-cache	squid	2.7:stable4
squid-cache	squid	2.7:stable5
squid-cache	squid	2.7:stable6
squid-cache	squid	2.7:stable7
squid-cache	squid	2.7:stable8
squid-cache	squid	2.7:stable9

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

squid

bullseye (security)	4.13-10+deb11u3 fixed
bullseye	4.13-10+deb11u3 fixed
bookworm	5.7-2+deb12u2 fixed
bookworm (security)	5.7-2+deb12u2 fixed
trixie	6.12-1 fixed
sid	6.12-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

squid

noble	Fixed 6.5-1ubuntu3 released
mantic	Fixed 6.1-2ubuntu1.2 released
lunar	Fixed 5.7-1ubuntu3.2 released
jammy	Fixed 5.7-0ubuntu0.22.04.3 released
focal	Fixed 4.10-1ubuntu1.9 released
bionic	ignored
xenial	ignored
trusty	ignored

squid3

noble	dne
mantic	dne
lunar	dne
jammy	dne
focal	dne
bionic	Fixed 3.5.27-1ubuntu1.14+esm2 released
xenial	Fixed 3.5.12-1ubuntu7.16+esm3 released
trusty	ignored

Common Weakness Enumeration

CWE-674 - Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch

http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch

https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3

https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/