[SECURITY] [DLA 3151-1] squid security update

2022-10-1219:31:44

lists.debian.org

squid

cve-2022-41317

cve-2022-41318

debian 10 buster

buffer overflow

web proxy cache

sensitive information

security update

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.1%

JSON

Debian LTS Advisory DLA-3151-1 [email protected]
https://www.debian.org/lts/security/ Abhijith PA
October 13, 2022 https://wiki.debian.org/LTS

Package : squid
Version : 4.6-1+deb10u8
CVE ID : CVE-2022-41317 CVE-2022-41318

Multiple vulnerabilities were discovered in squid, a Web Proxy cache

CVE-2022-41317

Due to inconsistent handling of internal URIs Squid is
vulnerable to Exposure of Sensitive Information about clients
using the proxy.

CVE-2022-41318

Due to an incorrect integer overflow protection Squid SSPI and
SMB authentication helpers are vulnerable to a Buffer Overflow
attack.

For Debian 10 buster, these problems have been fixed in version
4.6-1+deb10u8.

We recommend that you upgrade your squid packages.

For the detailed security status of squid please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/squid

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11mipselsquid-cgi-dbgsym< 4.13-10+deb11u2squid-cgi-dbgsym_4.13-10+deb11u2_mipsel.deb
Debian11mips64elsquid< 4.13-10+deb11u2squid_4.13-10+deb11u2_mips64el.deb
Debian11armelsquid-cgi-dbgsym< 4.13-10+deb11u2squid-cgi-dbgsym_4.13-10+deb11u2_armel.deb
Debian11i386squid-cgi< 4.13-10+deb11u2squid-cgi_4.13-10+deb11u2_i386.deb
Debian11amd64squid-purge-dbgsym< 4.13-10+deb11u2squid-purge-dbgsym_4.13-10+deb11u2_amd64.deb
Debian11armhfsquid-cgi-dbgsym< 4.13-10+deb11u2squid-cgi-dbgsym_4.13-10+deb11u2_armhf.deb
Debian10armhfsquid< 4.6-1+deb10u8squid_4.6-1+deb10u8_armhf.deb
Debian11ppc64elsquid-purge< 4.13-10+deb11u2squid-purge_4.13-10+deb11u2_ppc64el.deb
Debian11mipselsquid< 4.13-10+deb11u2squid_4.13-10+deb11u2_mipsel.deb
Debian11i386squidclient< 4.13-10+deb11u2squidclient_4.13-10+deb11u2_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	mipsel	squid-cgi-dbgsym	< 4.13-10+deb11u2	squid-cgi-dbgsym_4.13-10+deb11u2_mipsel.deb
Debian	11	mips64el	squid	< 4.13-10+deb11u2	squid_4.13-10+deb11u2_mips64el.deb
Debian	11	armel	squid-cgi-dbgsym	< 4.13-10+deb11u2	squid-cgi-dbgsym_4.13-10+deb11u2_armel.deb
Debian	11	i386	squid-cgi	< 4.13-10+deb11u2	squid-cgi_4.13-10+deb11u2_i386.deb
Debian	11	amd64	squid-purge-dbgsym	< 4.13-10+deb11u2	squid-purge-dbgsym_4.13-10+deb11u2_amd64.deb
Debian	11	armhf	squid-cgi-dbgsym	< 4.13-10+deb11u2	squid-cgi-dbgsym_4.13-10+deb11u2_armhf.deb
Debian	10	armhf	squid	< 4.6-1+deb10u8	squid_4.6-1+deb10u8_armhf.deb
Debian	11	ppc64el	squid-purge	< 4.13-10+deb11u2	squid-purge_4.13-10+deb11u2_ppc64el.deb
Debian	11	mipsel	squid	< 4.13-10+deb11u2	squid_4.13-10+deb11u2_mipsel.deb
Debian	11	i386	squidclient	< 4.13-10+deb11u2	squidclient_4.13-10+deb11u2_i386.deb