CVE-2018-1172 — NULL Pointer Dereference in Squid Software Foundation Squid

CWE-476 — NULL Pointer Dereference7 documents7 sources
Severity
5.9MEDIUMNVD
EPSS
8.7%
top 7.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
SquidTHE Squid Software Foundation SquidSquid-cache Squid
Timeline
PublishedMay 16
Latest updateMay 13

Description

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶Debiansquid/squid< 4.1-1+3
▶NVDsquid-cache/squid3.5.27

🔴Vulnerability Details

3
GHSA
GHSA-5pj9-pxj3-pc8r: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3↗2022-05-13
▶
OSV
CVE-2018-1172: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3↗2018-05-16
▶
CVEList
CVE-2018-1172: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3↗2018-05-16
▶

📋Vendor Advisories

2
Red Hat
squid: Incorrect pointer handling when processing ESI responses allows denial of service↗2018-04-18
▶
Debian
CVE-2018-1172: squid - This vulnerability allows remote attackers to deny service on vulnerable install...↗2018
▶

💬Community

1
Bugzilla
CVE-2018-1172 squid: Incorrect pointer handling when processing ESI responses allows denial of service↗2018-04-19
▶
CVE-2018-1172 — NULL Pointer Dereference | cvebase