cbcvebase.
CVE-2023-46847
published 2023-11-03

CVE-2023-46847: Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory…

PriorityP265high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
85.83%
99.7th percentile
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

Affected

29 ranges· showing 25
VendorProductVersion rangeFixed in
debiansquid< squid 5.7-2+deb12u1 (bookworm)squid 5.7-2+deb12u1 (bookworm)
msrcazl3_squid_6.13-1_on_azure_linux_3.0
redhatenterprise_linux
redhatenterprise_linux
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_for_arm_64
redhatenterprise_linux_for_ibm_z_systems
redhatenterprise_linux_for_power_little_endian
redhatenterprise_linux_server
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_tus
redhatenterprise_linux_server_tus
redhatenterprise_linux_server_tus
redhatenterprise_linux_server_tus
redhatenterprise_linux_server_tus
redhatenterprise_linux_workstation
squid-cachesquid>= 3.2.0.1 < 6.46.4
squidsquid>= 0 < 4.13-10+deb11u34.13-10+deb11u3
squidsquid>= 0 < 5.7-2+deb12u15.7-2+deb12u1

Detection & IOCsextracted from sources · hover to see the quote

  • Target Squid instances configured to accept HTTP Digest Authentication — the vulnerability is only exploitable when this authentication method is enabled
  • Monitor for anomalously large HTTP Digest Authentication headers/payloads (up to 2 MB) sent to Squid proxy — this is the attack vector for the heap buffer overflow
  • Watch for unexpected Squid process crashes or denial-of-service conditions, which may indicate exploitation attempts against the HTTP Digest Authentication handler
  • ·The vulnerability is only exploitable when Squid is explicitly configured to accept HTTP Digest Authentication; deployments not using Digest Authentication are not affected

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian8.6HIGH
vendor_msrc8.6HIGH
vendor_redhat8.6HIGH
vendor_ubuntu8.6HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.