An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.

An update of the squid package has been released.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: exposure of sensitive information in cache manager (CVE-2022-41317)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2024-33427)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: lack of UID assignment in child process spawning could lead to privileges escalation     (CVE-2019-12522)

  - squid: exposure of sensitive information in cache manager (CVE-2022-41317)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2024-33427)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-010 advisory.

  - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to     see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.
    If found, it servers the request. The absolute URL can include the decoded UserInfo (username and     password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to     provide a username that has special characters to delimit the domain, and treat the rest of the URL as a     path or query string. An attacker could first make a request to their domain using an encoded username,     then when a request for the target domain comes in that decodes to the exact URL, it will serve the     attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows     an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)

  - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to     see if the request should be denied. Squid by default comes with rules to block access to the Cache     Manager, which serves detailed server information meant for the maintainer. This rule is implemented via     url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to     encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2SQUID4-2023-002 advisory.

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-009 advisory.

  - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to     see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.
    If found, it servers the request. The absolute URL can include the decoded UserInfo (username and     password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to     provide a username that has special characters to delimit the domain, and treat the rest of the URL as a     path or query string. An attacker could first make a request to their domain using an encoded username,     then when a request for the target domain comes in that decodes to the exact URL, it will serve the     attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows     an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)

  - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to     see if the request should be denied. Squid by default comes with rules to block access to the Cache     Manager, which serves detailed server information meant for the maintainer. This rule is implemented via     url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to     encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1687 advisory.

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it     allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount     of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of     memory consumption. (CVE-2021-28651)

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it     allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger     memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This     attack is limited to clients with Cache Manager API access privilege. (CVE-2021-28652)

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is     vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request     processing. (CVE-2021-31806)

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a     remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue     trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.
    (CVE-2021-31807)

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is     vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP     Range request to trigger this. (CVE-2021-31808)

  - Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting     availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to     exist in HTTP traffic without any malicious intent by the server. (CVE-2021-33620)

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1950 advisory.

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it     allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount     of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of     memory consumption. (CVE-2021-28651)

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it     allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger     memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This     attack is limited to clients with Cache Manager API access privilege. (CVE-2021-28652)

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is     vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request     processing. (CVE-2021-31806)

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a     remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue     trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.
    (CVE-2021-31807)

  - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is     vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP     Range request to trigger this. (CVE-2021-31808)

  - Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting     availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to     exist in HTTP traffic without any malicious intent by the server. (CVE-2021-33620)

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-23e6ee1fb9 advisory.

  - This update for squid fixes the following issues: Updated squid to version 5.7: - CVE-2022-41317: Fixed     exposure of sensitive information in cache manager (bsc#1203677). - CVE-2022-41318: Fixed buffer overread     in SSPI and SMB Authentication (bsc#1203680). (CVE-2022-41317)

  - squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c8cad41c95 advisory.

  - This update for squid fixes the following issues: Updated squid to version 5.7: - CVE-2022-41317: Fixed     exposure of sensitive information in cache manager (bsc#1203677). - CVE-2022-41318: Fixed buffer overread     in SSPI and SMB Authentication (bsc#1203680). (CVE-2022-41317)

  - squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This update for squid fixes the following issues: Updated squid to version 5.7: - CVE-2022-41317: Fixed     exposure of sensitive information in cache manager (bsc#1203677). - CVE-2022-41318: Fixed buffer overread     in SSPI and SMB Authentication (bsc#1203680). (CVE-2022-41317)

  - squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5258 advisory.

  - Mikhail Evdokimov (aka konata) reports:              Due to inconsistent handling of internal URIs Squid     is             vulnerable to Exposure of Sensitive Information about             clients using the proxy.
    This problem allows a trusted             client to directly access cache manager information     bypassing the manager ACL protection. The available cache             manager information contains records     of internal network             structure, client credentials, client identity and client     traffic behaviour.            (CVE-2022-41317)

  - squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3596-1 advisory.

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

  - A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-     overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory     locations. In some configurations, cleartext credentials from these locations are sent to a client. This     is fixed in 5.7. (CVE-2022-41318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3151 advisory.

  - Mikhail Evdokimov (aka konata) reports:              Due to inconsistent handling of internal URIs Squid     is             vulnerable to Exposure of Sensitive Information about             clients using the proxy.
    This problem allows a trusted             client to directly access cache manager information     bypassing the manager ACL protection. The available cache             manager information contains records     of internal network             structure, client credentials, client identity and client     traffic behaviour.            (CVE-2022-41317)

  - squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3531-1 advisory.

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

  - A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-     overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory     locations. In some configurations, cleartext credentials from these locations are sent to a client. This     is fixed in 5.7. (CVE-2022-41318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3533-1 advisory.

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

  - A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-     overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory     locations. In some configurations, cleartext credentials from these locations are sent to a client. This     is fixed in 5.7. (CVE-2022-41318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3532-1 advisory.

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

  - A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-     overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory     locations. In some configurations, cleartext credentials from these locations are sent to a client. This     is fixed in 5.7. (CVE-2022-41318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5641-1 advisory.

    Mikhail Evdokimov discovered that Squid incorrectly handled cache manager ACLs. A remote attacker could     possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, and     Ubuntu 22.04 LTS. (CVE-2022-41317)

    It was discovered that Squid incorrectly handled SSPI and SMB authentication. A remote attacker could use     this issue to cause Squid to crash, resulting in a denial of service, or possibly obtain sensitive     information. (CVE-2022-41318)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f9ada0b5-3d80-11ed-9330-080027f5fec9 advisory.

  - Mikhail Evdokimov (aka konata) reports:              Due to inconsistent handling of internal URIs Squid     is             vulnerable to Exposure of Sensitive Information about             clients using the proxy.
    This problem allows a trusted             client to directly access cache manager information     bypassing the manager ACL protection. The available cache             manager information contains records     of internal network             structure, client credentials, client identity and client     traffic behaviour.            (CVE-2022-41317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203407	Photon OS 4.0: Squid PHSA-2023-4.0-0310	Nessus	PhotonOS Local Security Checks	high
198545	RHEL 9 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198508	RHEL 8 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
182658	Amazon Linux 2 : squid (ALASSQUID4-2023-010)	Nessus	Amazon Linux Local Security Checks	critical
182042	Amazon Linux 2 : squid (ALASSQUID4-2023-002)	Nessus	Amazon Linux Local Security Checks	medium
181962	Amazon Linux 2 : squid (ALASSQUID4-2023-009)	Nessus	Amazon Linux Local Security Checks	critical
171863	Amazon Linux AMI : squid (ALAS-2023-1687)	Nessus	Amazon Linux Local Security Checks	medium
171805	Amazon Linux 2 : squid (ALAS-2023-1950)	Nessus	Amazon Linux Local Security Checks	medium
169228	Fedora 35 : 7:squid (2022-23e6ee1fb9)	Nessus	Fedora Local Security Checks	high
169122	Fedora 36 : 7:squid (2022-c8cad41c95)	Nessus	Fedora Local Security Checks	high
168530	EulerOS 2.0 SP8 : squid (EulerOS-SA-2022-2807)	Nessus	Huawei Local Security Checks	high
166277	Debian DSA-5258-1 : squid - security update	Nessus	Debian Local Security Checks	high
166184	SUSE SLES15 Security Update : squid (SUSE-SU-2022:3596-1)	Nessus	SuSE Local Security Checks	high
166091	Debian DLA-3151-1 : squid - LTS security update	Nessus	Debian Local Security Checks	high
165756	SUSE SLES15 Security Update : squid (SUSE-SU-2022:3531-1)	Nessus	SuSE Local Security Checks	high
165754	SUSE SLES12 Security Update : squid (SUSE-SU-2022:3533-1)	Nessus	SuSE Local Security Checks	high
165743	SUSE SLES12 Security Update : squid (SUSE-SU-2022:3532-1)	Nessus	SuSE Local Security Checks	high
165459	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Squid vulnerabilities (USN-5641-1)	Nessus	Ubuntu Local Security Checks	high
165455	FreeBSD : squid -- Exposure of sensitive information in cache manager (f9ada0b5-3d80-11ed-9330-080027f5fec9)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2022-41317

medium

Tenable Plugins

high

medium

medium

critical

medium

critical

medium

medium

high

high

high

high

high

high

high

high

high

high

medium