CVE-2018-1172
published 2018-05-16CVE-2018-1172: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication…
PriorityP338medium5.9CVSS 3.0
AVNACHPRNUINSUCNINAH
EPSS
8.94%
94.6th percentile
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | squid | < squid 4.1-1 (bookworm) | squid 4.1-1 (bookworm) |
| squid-cache | squid | — | — |
| squid | squid | >= 0 < 4.1-1 | 4.1-1 |
| squid | squid | >= 0 < 4.1-1 | 4.1-1 |
| squid | squid | >= 0 < 4.1-1 | 4.1-1 |
| squid | squid | >= 0 < 4.1-1 | 4.1-1 |
| the_squid_software_foundation | the_squid_software_foundation_squid | — | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.9MEDIUM
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
squid: Incorrect pointer handling when processing ESI responses allows denial of service
vendor_redhat·2018-04-18·CVSS 5.9
CVE-2018-1172 [MEDIUM] CWE-476 squid: Incorrect pointer handling when processing ESI responses allows denial of service
squid: Incorrect pointer handling when processing ESI responses allows denial of service
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
it was found that Squid, when used as a reverse proxy, did not handle ESI responses properly. A malicious web server could use this flaw to crash Squid.
Statement: This issue affects the versions of squid and squid34 as shipped with Red
Debian
CVE-2018-1172: squid - This vulnerability allows remote attackers to deny service on vulnerable install...
vendor_debian·2018·CVSS 5.9
CVE-2018-1172 [MEDIUM] CVE-2018-1172: squid - This vulnerability allows remote attackers to deny service on vulnerable install...
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
Scope: local
bookworm: resolved (fixed in 4.1-1)
bullseye: resolved (fixed in 4.1-1)
forky: resolved (fixed in 4.1-1)
sid: resolved (fixed in 4.1-1)
trixie: resolved (fixed in 4.1-1)
GHSA
GHSA-5pj9-pxj3-pc8r: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3
ghsa_unreviewed·2022-05-13
CVE-2018-1172 [MEDIUM] CWE-476 GHSA-5pj9-pxj3-pc8r: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
OSV
CVE-2018-1172: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3
osv·2018-05-16·CVSS 5.9
CVE-2018-1172 [MEDIUM] CVE-2018-1172: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
No detection rules found.
No public exploits indexed.
2018-05-16
Published