Log in Start free

Vulnerability · Published Nov 3, 2023 · Assigned by redhat

CVE-2023-5824Squid: dos against http and https

High 7.5

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.3%top 11.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libecap1.0.1-2.module_el8.6.0+2741+01592ae8ALSA-2023:7668
AlmaLinux:8libecap1.0.1-2.module_el8.6.0+3048+383bc947ALSA-2023:7668
AlmaLinux:8libecap-devel1.0.1-2.module_el8.6.0+2741+01592ae8ALSA-2023:7668
AlmaLinux:8libecap-devel1.0.1-2.module_el8.6.0+3048+383bc947ALSA-2023:7668
AlmaLinux:8squid7:4.15-7.module_el8.9.0+3696+b881db49.3ALSA-2023:7668
AlmaLinux:9squid7:5.5-6.el9_3.2ALSA-2023:7465
Debian:12squid5.7-2+deb12u3DEBIAN-CVE-2023-5824
Debian:12squid5.7-2+deb12u3DSA-5982-1
Debian:13squid6.5-1DEBIAN-CVE-2023-5824
Debian:14squid6.5-1DEBIAN-CVE-2023-5824
Rocky Linux:8libecap0:1.0.1-2.module+el8.9.0+1437+df5ea8f0RLSA-2023:7668
Rocky Linux:8squid7:4.15-7.module+el8.9.0+1568+6d4fd5d4.1RLSA-2023:7668
Ubuntu:22.04:LTSsquid5.7-0ubuntu0.22.04.4USN-6728-1
Ubuntu:22.04:LTSsquid5.7-0ubuntu0.22.04.4UBUNTU-CVE-2023-5824
Ubuntu:24.04:LTSsquid6.5-1ubuntu1UBUNTU-CVE-2023-5824

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references

Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References