Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.

An update of the squid package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2822 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting     FTP, and HTTP data objects.

    Security Fix(es):

    * Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2777 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting     FTP, and HTTP data objects.

    Security Fix(es):

    * squid: denial of service in HTTP header parser (CVE-2024-25617)

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a414a81d47 advisory.

    - New squid 6.9
    - security update

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-bd8c6c6926 advisory.

    - New squid 6.9
    - security update

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1832 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting     FTP, and HTTP data objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    * squid: denial of service in HTTP header parser (CVE-2024-25617)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1833 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    * squid: denial of service in HTTP header parser (CVE-2024-25617)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6728-1 advisory.

    Joshua Rogers discovered that Squid incorrectly handled collapsed forwarding. A remote attacker could     possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only     affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)

    Joshua Rogers discovered that Squid incorrectly handled certain structural elements. A remote attacker     could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-5824)

    Joshua Rogers discovered that Squid incorrectly handled Cache Manager error responses. A remote trusted     client can possibly use this issue to cause Squid to crash, resulting in a denial of service.
    (CVE-2024-23638)

    Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked decoder. A remote attacker could     possibly use this issue to cause Squid to stop responding, resulting in a denial of service.
    (CVE-2024-25111)

    Joshua Rogers discovered that Squid incorrectly handled HTTP header parsing. A remote trusted client can     possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2024-25617)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1113-1 advisory.

  - Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.
    (CVE-2024-25111)

  - Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse     of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header     parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending     oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the     request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version     6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in     cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time     prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5.
    There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2     (CVE-2024-25617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1115-1 advisory.

  - Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.
    (CVE-2024-25111)

  - Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse     of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header     parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending     oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the     request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version     6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in     cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time     prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5.
    There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2     (CVE-2024-25617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1114-1 advisory.

  - Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.
    (CVE-2024-25111)

  - Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse     of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header     parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending     oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the     request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version     6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in     cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time     prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5.
    There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2     (CVE-2024-25617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-578 advisory.

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

  - Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling     of Structural Elements bug. (CVE-2023-5824)

  - Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6     is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a     trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid     older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and     including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by     Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in     Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access     control: `http_access deny manager`. (CVE-2024-23638)

  - Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.
    (CVE-2024-25111)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1515 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP and HTTP data objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1479 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1375 advisory.

    - Resolves: RHEL-19551 - squid:4/squid: denial of service in HTTP request       parsing (CVE-2023-50269)
    - Resolves: RHEL-28611 - squid:4/squid: Denial of Service in HTTP Chunked       Decoding (CVE-2024-25111)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-1376 advisory.

    - Resolves: RHEL-19555 - squid: denial of service in HTTP request       parsing (CVE-2023-50269)
    - Resolves: RHEL-28614 - squid: Denial of Service in HTTP Chunked       Decoding (CVE-2024-25111)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1376 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: denial of service in HTTP header parser (CVE-2024-25617)

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1375 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: denial of service in HTTP header parser (CVE-2024-25617)

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5637 advisory.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests. (CVE-2023-46728)

  - SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.
    (CVE-2023-46846)

  - Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication. (CVE-2023-46847)

  - Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs     in HTTP Request messages or constructing ftp:// URLs from FTP Native input. (CVE-2023-46848)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of     Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process     management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-49286)

  - Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through     2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial     of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of     Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is     configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. (CVE-2023-50269)

  - Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6     is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a     trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid     older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and     including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by     Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in     Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access     control: `http_access deny manager`. (CVE-2024-23638)

  - Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.
    (CVE-2024-25111)

  - Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse     of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header     parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending     oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the     request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version     6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in     cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time     prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5.
    There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2     (CVE-2024-25617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204804	Photon OS 3.0: Squid PHSA-2024-3.0-0751	Nessus	PhotonOS Local Security Checks	high
203580	Photon OS 5.0: Squid PHSA-2024-5.0-0249	Nessus	PhotonOS Local Security Checks	high
203520	Photon OS 4.0: Squid PHSA-2024-4.0-0593	Nessus	PhotonOS Local Security Checks	high
196897	RHEL 8 : squid:4 (RHSA-2024:2822)	Nessus	Red Hat Local Security Checks	high
195195	RHEL 8 : squid:4 (RHSA-2024:2777)	Nessus	Red Hat Local Security Checks	high
193864	Fedora 38 : squid (2024-a414a81d47)	Nessus	Fedora Local Security Checks	medium
193859	Fedora 39 : squid (2024-bd8c6c6926)	Nessus	Fedora Local Security Checks	medium
193415	RHEL 8 : squid:4 (RHSA-2024:1832)	Nessus	Red Hat Local Security Checks	high
193412	RHEL 9 : squid (RHSA-2024:1833)	Nessus	Red Hat Local Security Checks	high
193170	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Squid vulnerabilities (USN-6728-1)	Nessus	Ubuntu Local Security Checks	high
192992	SUSE SLES15 / openSUSE 15 Security Update : squid (SUSE-SU-2024:1113-1)	Nessus	SuSE Local Security Checks	high
192991	SUSE SLES12 Security Update : squid (SUSE-SU-2024:1115-1)	Nessus	SuSE Local Security Checks	high
192983	SUSE SLES15 Security Update : squid (SUSE-SU-2024:1114-1)	Nessus	SuSE Local Security Checks	high
192888	Amazon Linux 2023 : squid (ALAS2023-2024-578)	Nessus	Amazon Linux Local Security Checks	high
192586	RHEL 9 : squid (RHSA-2024:1515)	Nessus	Red Hat Local Security Checks	high
192528	RHEL 8 : squid:4 (RHSA-2024:1479)	Nessus	Red Hat Local Security Checks	high
192409	Oracle Linux 8 : squid:4 (ELSA-2024-1375)	Nessus	Oracle Linux Local Security Checks	high
192315	Oracle Linux 9 : squid (ELSA-2024-1376)	Nessus	Oracle Linux Local Security Checks	high
192264	RHEL 9 : squid (RHSA-2024:1376)	Nessus	Red Hat Local Security Checks	high
192255	RHEL 8 : squid:4 (RHSA-2024:1375)	Nessus	Red Hat Local Security Checks	high
191759	Debian dsa-5637 : squid - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2024-25111

high

Tenable Plugins

high

high

high

high

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

medium