[SECURITY] [DLA 3709-2] squid regression update

2024-01-2218:56:25

lists.debian.org

incomplete fix

update

squid

cve-2023-46846

buster

security

debian 10

9.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

8.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.4%

JSON

Debian LTS Advisory DLA-3709-2 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
January 22, 2024 https://wiki.debian.org/LTS

Package : squid
Version : 4.6-1+deb10u10
CVE ID : CVE-2023-46846
Debian Bug : 1060857

It was discovered that the fix for CVE-2023-46846 was incomplete. In some
cases Squid, a full featured web proxy cache, returned empty responses for
URLs when Transfer-Encoding: chunked was in use.

For Debian 10 buster, this problem has been fixed in version
4.6-1+deb10u10.

We recommend that you upgrade your squid packages.

For the detailed security status of squid please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/squid

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian10armhfsquidclient< 4.6-1+deb10u10squidclient_4.6-1+deb10u10_armhf.deb
Debian10i386squidclient-dbgsym< 4.6-1+deb10u10squidclient-dbgsym_4.6-1+deb10u10_i386.deb
Debian11i386squidclient< 4.13-10+deb11u3squidclient_4.13-10+deb11u3_i386.deb
Debian12ppc64elsquid-openssl< 5.7-2+deb12u1squid-openssl_5.7-2+deb12u1_ppc64el.deb
Debian12arm64squid< 5.7-2+deb12u1squid_5.7-2+deb12u1_arm64.deb
Debian10i386squid-cgi< 4.6-1+deb10u9squid-cgi_4.6-1+deb10u9_i386.deb
Debian12s390xsquid-openssl< 5.7-2+deb12u1squid-openssl_5.7-2+deb12u1_s390x.deb
Debian12armelsquid-openssl-dbgsym< 5.7-2+deb12u1squid-openssl-dbgsym_5.7-2+deb12u1_armel.deb
Debian12mips64elsquid-purge< 5.7-2+deb12u1squid-purge_5.7-2+deb12u1_mips64el.deb
Debian10allsquid-common< 4.6-1+deb10u9squid-common_4.6-1+deb10u9_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	armhf	squidclient	< 4.6-1+deb10u10	squidclient_4.6-1+deb10u10_armhf.deb
Debian	10	i386	squidclient-dbgsym	< 4.6-1+deb10u10	squidclient-dbgsym_4.6-1+deb10u10_i386.deb
Debian	11	i386	squidclient	< 4.13-10+deb11u3	squidclient_4.13-10+deb11u3_i386.deb
Debian	12	ppc64el	squid-openssl	< 5.7-2+deb12u1	squid-openssl_5.7-2+deb12u1_ppc64el.deb
Debian	12	arm64	squid	< 5.7-2+deb12u1	squid_5.7-2+deb12u1_arm64.deb
Debian	10	i386	squid-cgi	< 4.6-1+deb10u9	squid-cgi_4.6-1+deb10u9_i386.deb
Debian	12	s390x	squid-openssl	< 5.7-2+deb12u1	squid-openssl_5.7-2+deb12u1_s390x.deb
Debian	12	armel	squid-openssl-dbgsym	< 5.7-2+deb12u1	squid-openssl-dbgsym_5.7-2+deb12u1_armel.deb
Debian	12	mips64el	squid-purge	< 5.7-2+deb12u1	squid-purge_5.7-2+deb12u1_mips64el.deb
Debian	10	all	squid-common	< 4.6-1+deb10u9	squid-common_4.6-1+deb10u9_all.deb