Arch Linux Security Advisory ASA-202105-10 ========================================== Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-28651 CVE-2021-28652 CVE-2021-28662 Package : squid Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1949 Summary ======= The package squid before version 4.15-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.15-1. # pacman -Syu "squid>=4.15-1" The problems have been fixed upstream in version 4.15. Workaround ========== - CVE-2021-28651 can be mitigated by disabling URN processing by the proxy, by adding these lines to squid.conf: acl URN proto URN http_access deny URN - CVE-2021-28652 can be mitigated by either disabling Cache Manager access entirely if not needed, by placing the following line in squid.conf before lines containing "allow": http_access deny manager or by hardening Cache Manager access privileges, for example: require authentication or other access controls in http_access beyond the default IP address restriction. - No known mitigations exist for CVE-2021-28662. Description =========== - CVE-2021-28651 (denial of service) Due to a buffer management bug Squid before version 4.15 is vulnerable to a denial of service attack against the server it is operating on. This attack is limited to proxies which attempt to resolve a "urn:" resource identifier. Support for this resolving is enabled by default in all Squid. - CVE-2021-28652 (denial of service) Due to an incorrect parser validation bug Squid before version 4.15 is vulnerable to a denial of Service attack against the Cache Manager API. - CVE-2021-28662 (denial of service) Due to an input validation bug Squid before version 4.15 is vulnerable to a denial of service against all clients using the proxy. Impact ====== A remote attacker can cause denial of service through crafted requests. References ========== https://github.com/squid-cache/squid/security/advisories/GHSA-ch36-9jhx-phm4 http://www.squid-cache.org/Versions/v4/changesets/squid-4-a975fd5aedc8666292... https://github.com/squid-cache/squid/security/advisories/GHSA-m47m-9hvw-7447 http://www.squid-cache.org/Versions/v4/changesets/squid-4-0003e3518dc95e4b5a... https://github.com/squid-cache/squid/security/advisories/GHSA-jjq6-mh2h-g39h http://www.squid-cache.org/Versions/v4/changesets/squid-4-b1c37c9e7b30d0efb5... https://security.archlinux.org/CVE-2021-28651 https://security.archlinux.org/CVE-2021-28652 https://security.archlinux.org/CVE-2021-28662