CVE-2022-41317

2022-12-2519:15:10

Alpine Linux Development Team

security.alpinelinux.org

squid

uri handling

vulnerability

sensitive information

https request

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.1%

JSON

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.

OSVersionArchitecturePackageVersionFilename
Alpineedge-mainnoarchsquid< 5.7-r0UNKNOWN
Alpine3.19-mainnoarchsquid< 5.7-r0UNKNOWN
Alpine3.20-mainnoarchsquid< 5.7-r0UNKNOWN