Home

CVE-2021-28652

Description

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.

Risk Information

Base Score
4.9
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.539

Associated Vulnerability

VulnerabilityOS Platform
SUSE-SU-2021:1838-1(SUSE Linux Enterprise Server 12-SP5 ) squid-4.15-4.18.1.x86_64.rpmLinux
SUSE-SU-2021:1838-1(SUSE Linux Enterprise Server 12-SP5 ) squid-debuginfo-4.15-4.18.1.x86_64.rpmLinux
SUSE-SU-2021:1838-1(SUSE Linux Enterprise Server 12-SP5 ) squid-debugsource-4.15-4.18.1.x86_64.rpmLinux
squid security update(DSA-4924-1) squid_4.6-1+deb10u6_i386.debLinux
squid security update(DSA-4924-1) squid_4.6-1+deb10u6_amd64.debLinux
Web proxy cache server (USN-4981-1) squid_4.10-1ubuntu1.4_amd64.debLinux
Web proxy cache server (USN-4981-1) squid_4.13-1ubuntu2.2_amd64.debLinux
Web proxy cache server (USN-4981-1) squid_4.13-1ubuntu4.1_amd64.debLinux
Web proxy cache server (USN-4981-1) squid_3.5.27-1ubuntu1.11_i386.debLinux
Web proxy cache server (USN-4981-1) squid_3.5.27-1ubuntu1.11_amd64.debLinux
Squid update (ELSA-2021-9465) squid-3.5.20-17.0.1.el7_9.6.x86_64.rpmLinux
Squid-migration-script update (ELSA-2021-9465) squid-migration-script-3.5.20-17.0.1.el7_9.6.x86_64.rpmLinux
Squid-sysvinit update (ELSA-2021-9465) squid-sysvinit-3.5.20-17.0.1.el7_9.6.x86_64.rpmLinux
Squid update (ELSA-2022-5542) squid-3.5.20-17.0.1.el7_9.7.x86_64.rpmLinux
Squid-migration-script update (ELSA-2022-5542) squid-migration-script-3.5.20-17.0.1.el7_9.7.x86_64.rpmLinux
Squid-sysvinit update (ELSA-2022-5542) squid-sysvinit-3.5.20-17.0.1.el7_9.7.x86_64.rpmLinux
Squid update (ELSA-2022-6815) squid-3.5.20-17.0.1.el7_9.8.x86_64.rpmLinux
Squid-migration-script update (ELSA-2022-6815) squid-migration-script-3.5.20-17.0.1.el7_9.8.x86_64.rpmLinux
Squid-sysvinit update (ELSA-2022-6815) squid-sysvinit-3.5.20-17.0.1.el7_9.8.x86_64.rpmLinux
Squid update (ELSA-2023-6805) squid-3.5.20-17.0.1.el7_9.9.x86_64.rpmLinux
Squid-migration-script update (ELSA-2023-6805) squid-migration-script-3.5.20-17.0.1.el7_9.9.x86_64.rpmLinux
Squid update (ELSA-2024-1787) squid-3.5.20-17.0.1.el7_9.10.x86_64.rpmLinux
Squid-migration-script update (ELSA-2024-1787) squid-migration-script-3.5.20-17.0.1.el7_9.10.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234