CVE-2023-50269

EUVD-2023-55081

14.12.2023, 18:15

Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
GitHub_M	CNA	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 79%

Affected Products (NVD)

Vendor	Product	Version
squid-cache	squid	3.1 ≤ 𝑥 ≤ 5.9
squid-cache	squid	6.0.1 ≤ 𝑥 ≤ 6.5
squid-cache	squid	2.6
squid-cache	squid	2.7
squid-cache	squid	2.7:stable1
squid-cache	squid	2.7:stable2
squid-cache	squid	2.7:stable3
squid-cache	squid	2.7:stable4
squid-cache	squid	2.7:stable5
squid-cache	squid	2.7:stable6
squid-cache	squid	2.7:stable7
squid-cache	squid	2.7:stable8
squid-cache	squid	2.7:stable9

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

squid

bookworm	5.7-2+deb12u2 fixed
bookworm (security)	5.7-2+deb12u2 fixed
bullseye	4.13-10+deb11u3 fixed
bullseye (security)	4.13-10+deb11u3 fixed
sid	6.12-1 fixed
trixie	6.12-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

squid

bionic	ignored
focal	Fixed 4.10-1ubuntu1.9 released
jammy	Fixed 5.7-0ubuntu0.22.04.3 released
lunar	Fixed 5.7-1ubuntu3.2 released
mantic	Fixed 6.1-2ubuntu1.2 released
noble	Fixed 6.5-1ubuntu3 released
trusty	ignored
xenial	ignored

squid3

bionic	Fixed 3.5.27-1ubuntu1.14+esm2 released
focal	dne
jammy	dne
lunar	dne
mantic	dne
noble	dne
trusty	ignored
xenial	Fixed 3.5.12-1ubuntu7.16+esm3 released

Common Weakness Enumeration

CWE-674 - Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch

http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch

https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3

https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/