Debian Security Advisory
DSA-4122-1 squid3 -- security update
- Date Reported:
- 23 Feb 2018
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 888719, Bug 888720.
In Mitre's CVE dictionary: CVE-2018-1000024, CVE-2018-1000027.
- More information:
Several vulnerabilities have been discovered in Squid3, a fully featured web proxy cache. The Common Vulnerabilities and Exposures project identifies the following issues:
Louis Dion-Marcil discovered that Squid does not properly handle processing of certain ESI responses. A remote server delivering certain ESI response syntax can take advantage of this flaw to cause a denial of service for all clients accessing the Squid service. This problem is limited to the Squid custom ESI parser.
Louis Dion-Marcil discovered that Squid is prone to a denial of service vulnerability when processing ESI responses or downloading intermediate CA certificates. A remote attacker can take advantage of this flaw to cause a denial of service for all clients accessing the Squid service.
For the oldstable distribution (jessie), these problems have been fixed in version 3.4.8-6+deb8u5.
For the stable distribution (stretch), these problems have been fixed in version 3.5.23-5+deb9u1.
We recommend that you upgrade your squid3 packages.
For the detailed security status of squid3 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/squid3