<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-IL" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="en-IL">Hi<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-IL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-IL">I'm running Squid on Ubuntu 22.04<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-IL">I ran a vulnerability scan on this server and got a result from the vendor that this version is vulnerable. See. Is there any way to fix it?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-IL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#1D1C1D;background:#F8F8F8">Vulnerability Details</span><span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#1D1C1D"><br>
<span style="background:#F8F8F8">Name</span><br>
<span style="background:#F8F8F8">Squid Multiple 0-Day Vulnerabilities (Oct 2023)</span><br>
<span style="background:#F8F8F8">Found On</span><br>
<span style="background:#F8F8F8">X.X.X.X</span><br>
<span style="background:#F8F8F8">Insight<o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#1D1C1D"><br>
<span style="background:#F8F8F8">The following flaws have been reported in 2021 to the vendor and seems to be not fixed yet: - Use-After-Free in TRACE Requests - X-Forwarded-For Stack Overflow - Chunked Encoding Stack Overflow - Use-After-Free in Cache Manager
Errors - Memory Leak in HTTP Response Parsing - Memory Leak in ESI Error Processing - 1-Byte Buffer OverRead in RFC 1123 date/time Handling GHSA-8w9r-p88v-mmx9 - One-Byte Buffer OverRead in HTTP Request Header Parsing - strlen(NULL) Crash Using Digest Authentication
GHSA-254c-93q9-cp53 - Assertion in ESI Header Handling - Gopher Assertion Crash - Whois Assertion Crash - RFC 2141 / 2169 (URN) Assertion Crash - Assertion in Negotiate/NTLM Authentication Using Pipeline Prefetching - Assertion on IPv6 Host Requests with --disable-ipv6
- Assertion Crash on Unexpected 'HTTP/1.1 100 Continue' Response Header - Pipeline Prefetch Assertion With Double 'Expect:100-continue' Request Headers - Pipeline Prefetch Assertion With Invalid Headers - Assertion Crash in Deferred Requests - Assertion in
Digest Authentication - FTP Authentication Crash - Assertion Crash In HTTP Response Headers Handling - Implicit Assertion in Stream Handling - Use-After-Free in ESI 'Try' (and 'Choose') Processing - Use-After-Free in ESI Expression Evaluation - Buffer Underflow
in ESI GHSA-wgvf-q977-9xjg - Assertion in Squid 'Helper' Process Creator GHSA-xggx-9329-3c27 - Assertion Due to 0 ESI 'when' Checking GHSA-4g88-277m-q89r - Assertion Using ESI's When Directive GHSA-4g88-277m-q89r - Assertion in ESI Variable Assignment (String)
- Assertion in ESI Variable Assignment - Null Pointer Dereference In ESI's esi:include and esi:when Note: Various GHSA advisories have been provided by the security researcher but are not published / available yet.</span></span><span lang="en-IL"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-IL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="en-IL" style="font-family:"Calibri",sans-serif;color:black;mso-ligatures:none;mso-fareast-language:#2000"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>