8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
9.4 High
AI Score
Confidence
High
0.03 Low
EPSS
Percentile
91.0%
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.
[
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid34",
"defaultStatus": "affected",
"versions": [
{
"version": "7:3.4.14-15.el6_10.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid",
"defaultStatus": "affected",
"versions": [
{
"version": "7:3.1.23-24.el6_10.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid",
"defaultStatus": "affected",
"versions": [
{
"version": "7:3.5.20-17.el7_9.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:7::server",
"cpe:/o:redhat:enterprise_linux:7::workstation"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7.6 Advanced Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid",
"defaultStatus": "affected",
"versions": [
{
"version": "7:3.5.20-12.el7_6.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:rhel_aus:7.6::server"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7.7 Advanced Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid",
"defaultStatus": "affected",
"versions": [
{
"version": "7:3.5.20-13.el7_7.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:rhel_aus:7.7::server"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8080020231030214932.63b34585",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8090020231030224841.a75119d5",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8010020231101141358.c27ad7f8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.1::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8020020231101135052.4cda2c84",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_tus:8.2::appstream",
"cpe:/a:redhat:rhel_aus:8.2::appstream",
"cpe:/a:redhat:rhel_e4s:8.2::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8020020231101135052.4cda2c84",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_tus:8.2::appstream",
"cpe:/a:redhat:rhel_aus:8.2::appstream",
"cpe:/a:redhat:rhel_e4s:8.2::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8020020231101135052.4cda2c84",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_tus:8.2::appstream",
"cpe:/a:redhat:rhel_aus:8.2::appstream",
"cpe:/a:redhat:rhel_e4s:8.2::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8040020231101101624.522a0ee4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_e4s:8.4::appstream",
"cpe:/a:redhat:rhel_tus:8.4::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8040020231101101624.522a0ee4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_e4s:8.4::appstream",
"cpe:/a:redhat:rhel_tus:8.4::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8040020231101101624.522a0ee4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_e4s:8.4::appstream",
"cpe:/a:redhat:rhel_tus:8.4::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid:4",
"defaultStatus": "affected",
"versions": [
{
"version": "8060020231031165747.ad008a3a",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:8.6::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid",
"defaultStatus": "affected",
"versions": [
{
"version": "7:5.5-5.el9_2.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid",
"defaultStatus": "affected",
"versions": [
{
"version": "7:5.5-6.el9_3.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "squid",
"defaultStatus": "affected",
"versions": [
{
"version": "7:5.2-1.el9_0.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.0::appstream"
]
}
]
access.redhat.com/errata/RHSA-2023:6266
access.redhat.com/errata/RHSA-2023:6267
access.redhat.com/errata/RHSA-2023:6268
access.redhat.com/errata/RHSA-2023:6748
access.redhat.com/errata/RHSA-2023:6801
access.redhat.com/errata/RHSA-2023:6803
access.redhat.com/errata/RHSA-2023:6804
access.redhat.com/errata/RHSA-2023:6805
access.redhat.com/errata/RHSA-2023:6810
access.redhat.com/errata/RHSA-2023:6882
access.redhat.com/errata/RHSA-2023:6884
access.redhat.com/errata/RHSA-2023:7213
access.redhat.com/errata/RHSA-2023:7576
access.redhat.com/errata/RHSA-2023:7578
access.redhat.com/security/cve/CVE-2023-46847
bugzilla.redhat.com/show_bug.cgi?id=2245916
github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g
lists.debian.org/debian-lts-announce/2024/01/msg00003.html
security.netapp.com/advisory/ntap-20231130-0002/
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
9.4 High
AI Score
Confidence
High
0.03 Low
EPSS
Percentile
91.0%