CVE-2023-46847

CWE-120 — Classic Buffer Overflow9 documents7 sources
Severity
7.5HIGH
EPSS
38.2%
top 2.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Squid-cache SquidRedhat Enterprise LinuxRedhat Enterprise Linux EUS+7 more
Timeline
PublishedNov 3
Latest updateDec 11

Description

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HExploitability: 3.9 | Impact: 4.7

Affected Packages4 packages

▶NVDsquid-cache/squid3.2.0.1 — 6.4
▶Debiansquid< 4.13-10+deb11u3+3

Also affects: Enterprise Linux 8.0, 9.0, 8.6, 8.8, 9.2, 8.2, 8.4

🔴Vulnerability Details

3
OSV
squid3 vulnerabilities↗2023-12-11
▶
CVEList
Squid: denial of service in http digest authentication↗2023-11-03
▶
OSV
CVE-2023-46847: Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap↗2023-11-03
▶

📋Vendor Advisories

5
Ubuntu
Squid vulnerabilities↗2023-12-11
▶
Ubuntu
Squid vulnerabilities↗2023-11-21
▶
Microsoft
Squid: denial of service in http digest authentication↗2023-11-14
▶
Red Hat
squid: Denial of Service in HTTP Digest Authentication↗2023-10-19
▶
Debian
CVE-2023-46847: squid - Squid is vulnerable to a Denial of Service, where a remote attacker can perform...↗2023
▶