Due to an input validation bug Squid is vulnerable to a Denial
of Service against all clients using the proxy.
Severity:
This problem allows a remote server to perform Denial of Service
when delivering HTTP Response messages. The issue trigger is a
header which can be expected to exist in HTTP traffic without
any malicious intent by the server
For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used http://bugs.squid-cache.org/.
For reporting of security sensitive bugs send an email to the squid-bugs@lists.squid-cache.org mailing list. It's a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.
Credits:
This vulnerability was discovered by Joshua Rogers of Opera
Software.
Fixed by Alex Rousskov of The Measurement Factory.
Revision history:
2021-03-05 22:11:43 UTC Initial Report
2021-05-28 11:29:59 UTC CVE Assignment
END
Severity
Moderate
6.5
/ 10
CVSS base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID
CVE-2021-33620
Weaknesses
No CWEs
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.
Due to an input validation bug Squid is vulnerable to a Denial
of Service against all clients using the proxy.
Severity:
This problem allows a remote server to perform Denial of Service
when delivering HTTP Response messages. The issue trigger is a
header which can be expected to exist in HTTP traffic without
any malicious intent by the server
CVSS Score of 8.8
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C/CR:X/IR:X/AR:H/MAV:N/MAC:L/MPR:L/MUI:N/MS:C/MC:X/MI:X/MA:H&version=3.1
Updated Packages:
This bug is fixed by Squid versions 4.15 and 5.0.6.
In addition, patches addressing this problem for the stable
releases can be found in our patch archives:
Squid 4:
http://www.squid-cache.org/Versions/v4/changesets/squid-4-1e05a85bd28c22c9ca5d3ac9f5e86d6269ec0a8c.patch
Squid 5:
http://www.squid-cache.org/Versions/v5/changesets/squid-5-8af775ed98bfd610f9ce762fe177e01b2675588c.patch
If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.
Determining if your version is vulnerable:
Squid older than 4.15 have not been tested and should be
assumed to be vulnerable.
All Squid-5.x up to and including 5.0.5 are vulnerable.
Workaround:
There are no known workarounds to this issue.
Contact details for the Squid project:
For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.
If you install and build Squid from the original Squid sources
then the squid-users@lists.squid-cache.org mailing list is your
primary support point. For subscription details see
http://www.squid-cache.org/Support/mailing-lists.html.
For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
http://bugs.squid-cache.org/.
For reporting of security sensitive bugs send an email to the
squid-bugs@lists.squid-cache.org mailing list. It's a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.
Credits:
This vulnerability was discovered by Joshua Rogers of Opera
Software.
Fixed by Alex Rousskov of The Measurement Factory.
Revision history:
2021-03-05 22:11:43 UTC Initial Report
2021-05-28 11:29:59 UTC CVE Assignment
END