Vulnerability · Published Jun 25, 2024 · Assigned by GitHub_M

CVE-2024-37894Squid vulnerable to heap corruption in ESI assign

Medium 6.3

In plain English

A medium-severity out-of-bounds write in squid from squid-cache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.3% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)6.3%top 6.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:9	squid	7:5.5-13.el9_4	ALSA-2024:4861
Debian:12	squid	5.7-2+deb12u2	DEBIAN-CVE-2024-37894
Debian:12	squid	5.7-2+deb12u2	DSA-5751-1
Debian:13	squid	6.10-1	DEBIAN-CVE-2024-37894
Debian:14	squid	6.10-1	DEBIAN-CVE-2024-37894
Rocky Linux:9	squid	7:5.5-13.el9_4	RLSA-2024:4861
Ubuntu:22.04:LTS	squid	5.9-0ubuntu0.22.04.2	USN-6907-1
Ubuntu:22.04:LTS	squid	5.9-0ubuntu0.22.04.2	UBUNTU-CVE-2024-37894
Ubuntu:24.04:LTS	squid	6.6-1ubuntu5.1	USN-6907-1
Ubuntu:24.04:LTS	squid	6.6-1ubuntu5.1	UBUNTU-CVE-2024-37894

Affected products (as reported)

Vendor	Product	Versions
squid-cache	squid	>= 3.0, <= 3.5.28>= 4.0, <= 4.16>= 5.0, <= 5.9>= 6.0, <= 6.9

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References