[ASA-202105-10] squid: denial of service
diabonas at archlinux.org
Thu May 20 18:05:49 UTC 2021
Arch Linux Security Advisory ASA-202105-10
Date : 2021-05-19
CVE-ID : CVE-2021-28651 CVE-2021-28652 CVE-2021-28662
Package : squid
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-1949
The package squid before version 4.15-1 is vulnerable to denial of
Upgrade to 4.15-1.
# pacman -Syu "squid>=4.15-1"
The problems have been fixed upstream in version 4.15.
- CVE-2021-28651 can be mitigated by disabling URN processing by the
proxy, by adding these lines to squid.conf:
acl URN proto URN
http_access deny URN
- CVE-2021-28652 can be mitigated by either disabling Cache Manager
access entirely if not needed, by placing the following line in
squid.conf before lines containing "allow":
http_access deny manager
or by hardening Cache Manager access privileges, for example: require
authentication or other access controls in http_access beyond the
default IP address restriction.
- No known mitigations exist for CVE-2021-28662.
- CVE-2021-28651 (denial of service)
Due to a buffer management bug Squid before version 4.15 is vulnerable
to a denial of service attack against the server it is operating on.
This attack is limited to proxies which attempt to resolve a "urn:"
resource identifier. Support for this resolving is enabled by default
in all Squid.
- CVE-2021-28652 (denial of service)
Due to an incorrect parser validation bug Squid before version 4.15 is
vulnerable to a denial of Service attack against the Cache Manager API.
- CVE-2021-28662 (denial of service)
Due to an input validation bug Squid before version 4.15 is vulnerable
to a denial of service against all clients using the proxy.
A remote attacker can cause denial of service through crafted requests.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security