Home

CVE-2021-31808

Description

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.

Risk Information

Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.33

Associated Vulnerability

VulnerabilityOS Platform
squid security update(DSA-4924-1) squid_4.6-1+deb10u6_i386.debLinux
squid security update(DSA-4924-1) squid_4.6-1+deb10u6_amd64.debLinux
Web proxy cache server (USN-4981-1) squid_4.10-1ubuntu1.4_amd64.debLinux
Web proxy cache server (USN-4981-1) squid_4.13-1ubuntu2.2_amd64.debLinux
Web proxy cache server (USN-4981-1) squid_4.13-1ubuntu4.1_amd64.debLinux
Web proxy cache server (USN-4981-1) squid_3.5.27-1ubuntu1.11_i386.debLinux
Web proxy cache server (USN-4981-1) squid_3.5.27-1ubuntu1.11_amd64.debLinux
Squid update (ELSA-2021-9465) squid-3.5.20-17.0.1.el7_9.6.x86_64.rpmLinux
Squid-migration-script update (ELSA-2021-9465) squid-migration-script-3.5.20-17.0.1.el7_9.6.x86_64.rpmLinux
Squid-sysvinit update (ELSA-2021-9465) squid-sysvinit-3.5.20-17.0.1.el7_9.6.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234