CVE-2021-46784
published 2022-07-17CVE-2021-46784: In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher…
PriorityP334medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
3.62%
88.1th percentile
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | squid | < squid 5.6-1 (bookworm) | squid 5.6-1 (bookworm) |
| squid-cache | squid | 3.0 – 3.5.28 | — |
| squid-cache | squid | 4.0 – 4.17 | — |
| squid-cache | squid | >= 5.0 < 5.6 | 5.6 |
| squid | squid | >= 0 < 4.13-10+deb11u1 | 4.13-10+deb11u1 |
| squid | squid | >= 0 < 5.6-1 | 5.6-1 |
| squid | squid | >= 0 < 5.6-1 | 5.6-1 |
| squid | squid | >= 0 < 5.6-1 | 5.6-1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
squid: DoS when processing gopher server responses
vendor_redhat·2022-06-23·CVSS 6.5
CVE-2021-46784 [MEDIUM] CWE-617 squid: DoS when processing gopher server responses
squid: DoS when processing gopher server responses
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
A vulnerability was found in squid (Web proxy cache server). This issue occurs due to improper buffer management while processing Gopher server responses. This flaw leads to a remote denial of service or a crash if it receives specially crafted network traffic, either by mistake or a malicious actor.
Package: squid (Red Hat Enterprise Linux 6) - Out of support scope
Package: squid34 (Red Hat Enterprise Linux 6) - Out of support scope
Ubuntu
Squid vulnerability
vendor_ubuntu·2022-06-22
CVE-2021-46784 Squid vulnerability
Title: Squid vulnerability
Summary: Squid could be made to crash if it received specially crafted network
traffic.
Joshua Rogers discovered that Squid incorrectly handled the Gopher
protocol. A remote attacker could possibly use this issue to cause Squid to
crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2021-46784: squid - In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improp...
vendor_debian·2021·CVSS 6.5
CVE-2021-46784 [MEDIUM] CVE-2021-46784: squid - In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improp...
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
Scope: local
bookworm: resolved (fixed in 5.6-1)
bullseye: resolved (fixed in 4.13-10+deb11u1)
forky: resolved (fixed in 5.6-1)
sid: resolved (fixed in 5.6-1)
trixie: resolved (fixed in 5.6-1)
OSV
CVE-2021-46784: In Squid 3
osv·2022-07-17·CVSS 6.5
CVE-2021-46784 [MEDIUM] CVE-2021-46784: In Squid 3
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2023/10/13/1http://www.openwall.com/lists/oss-security/2023/10/13/10http://www.openwall.com/lists/oss-security/2023/10/21/1http://www.squid-cache.org/Versions/v4/changesets/SQUID-2021_7.patchhttp://www.squid-cache.org/Versions/v5/changesets/SQUID-2021_7.patchhttps://github.com/squid-cache/squid/commit/5e2ea2b13bd98f53e29964ca26bb0d602a8a12b9https://github.com/squid-cache/squid/security/advisories/GHSA-f5cp-6rh3-284whttps://security-tracker.debian.org/tracker/CVE-2021-46784https://security.netapp.com/advisory/ntap-20221223-0007/http://www.openwall.com/lists/oss-security/2023/10/13/1http://www.openwall.com/lists/oss-security/2023/10/13/10http://www.openwall.com/lists/oss-security/2023/10/21/1http://www.squid-cache.org/Versions/v4/changesets/SQUID-2021_7.patchhttp://www.squid-cache.org/Versions/v5/changesets/SQUID-2021_7.patchhttps://github.com/squid-cache/squid/commit/5e2ea2b13bd98f53e29964ca26bb0d602a8a12b9https://github.com/squid-cache/squid/security/advisories/GHSA-f5cp-6rh3-284whttps://security-tracker.debian.org/tracker/CVE-2021-46784https://security.netapp.com/advisory/ntap-20221223-0007/
2022-07-17
Published