Vulnerability · Published Oct 18, 2021 · Assigned by mitre
CVE-2021-41611
High 7.5
In plain English
A high-severity security flaw in the squid package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | squid | 5.2-r0 | ALPINE-CVE-2021-41611 |
| Alpine:v3.21 | squid | 5.2-r0 | ALPINE-CVE-2021-41611 |
| Alpine:v3.22 | squid | 5.2-r0 | ALPINE-CVE-2021-41611 |
| Alpine:v3.23 | squid | 5.2-r0 | ALPINE-CVE-2021-41611 |
| Alpine:v3.24 | squid | 5.2-r0 | ALPINE-CVE-2021-41611 |
| Debian:12 | squid | 5.2-1 | DEBIAN-CVE-2021-41611 |
| Debian:13 | squid | 5.2-1 | DEBIAN-CVE-2021-41611 |
| Debian:14 | squid | 5.2-1 | DEBIAN-CVE-2021-41611 |
Affected products (as reported)
References
- http://www.squid-cache.org/Versions/v6/changesets/squid-6-43d6b5c81b88ec2256b430c69a872a1e4f324e4a.patch x_refsource_MISC
- https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r x_refsource_CONFIRM
- FEDORA-2021-15d2f70a07 vendor-advisory, x_refsource_FEDORA
- [oss-security] 20211223 CVE-2021-44273: e2guardian did not validate TLS hostnames mailing-list, x_refsource_MLIST