squid security update

2023-11-1600:00:00

linux.oracle.com

security update

ftp

http digest

request/response smuggling

crash

half_closed_client

unix

CVSS3

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

EPSS

0.03

Percentile

91.1%

JSON

[7:5.5-6.1]

Resolves: RHEL-14819 - squid: squid: denial of Servicein FTP
Resolves: RHEL-14807 - squid: squid: Denial of Service in HTTP Digest
Authentication
Resolves: RHEL-14780 - squid: squid: Request/Response smuggling in HTTP/1.1
and ICAP
[7:5.5-6]
Resolves: #2231827 - Crash with half_closed_client on

OSVersionArchitecturePackageVersionFilename
oracle linux9srcsquid< 5.5-6.el9_3.1squid-5.5-6.el9_3.1.src.rpm
oracle linux9aarch64squid< 5.5-6.el9_3.1squid-5.5-6.el9_3.1.aarch64.rpm
oracle linux9srcsquid< 5.5-6.el9_3.1squid-5.5-6.el9_3.1.src.rpm
oracle linux9x86_64squid< 5.5-6.el9_3.1squid-5.5-6.el9_3.1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	9	src	squid	< 5.5-6.el9_3.1	squid-5.5-6.el9_3.1.src.rpm
oracle linux	9	aarch64	squid	< 5.5-6.el9_3.1	squid-5.5-6.el9_3.1.aarch64.rpm
oracle linux	9	src	squid	< 5.5-6.el9_3.1	squid-5.5-6.el9_3.1.src.rpm
oracle linux	9	x86_64	squid	< 5.5-6.el9_3.1	squid-5.5-6.el9_3.1.x86_64.rpm