RHSA-2021:4292

Vulnerability from csaf_opensuse - Published: 2021-11-09 00:00 - Updated: 2026-09-20 11:17
Summary
security update for libecap
Severity
Moderate
Notes
Title of the patch: security update for libecap
Description of the patch: This security update provides a functional equivalent of RHSA-2021:4292. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2021:4292.
Patchnames: RHSA-2021:4292
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2021-28651
7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4 —
Vendor Fix
Threats
Impact important
CVE-2021-28652
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Affected products
Recommended 3 products, the same list as for CVE-2021-28651
Threats
Impact moderate
CVE-2021-28662
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 3 products, the same list as for CVE-2021-28651
Threats
Impact moderate
CVE-2021-31806
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 3 products, the same list as for CVE-2021-28651
Threats
Impact moderate
CVE-2021-31807
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 3 products, the same list as for CVE-2021-28651
Threats
Impact moderate
CVE-2021-31808
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 3 products, the same list as for CVE-2021-28651
Threats
Impact moderate
CVE-2021-33620
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 3 products, the same list as for CVE-2021-28651
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for libecap",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2021:4292.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2021:4292.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2021:4292",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2021_4292.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-28651 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-28651/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-28652 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-28652/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-28662 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-28662/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-31806 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-31806/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-31807 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-31807/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-31808 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-31808/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-33620 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-33620/"
      }
    ],
    "title": "security update for libecap",
    "tracking": {
      "current_release_date": "2026-09-20T11:17:31Z",
      "generator": {
        "date": "2021-11-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2021:4292",
      "initial_release_date": "2021-11-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2021-11-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:17:31Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
                "product": {
                  "name": "libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64 (squid:4)",
                  "product_id": "libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libecap@1.0.1-2.module+el8.1.0+4044+36416a77?arch=x86_64\u0026rpmmod=squid:4:8000020221004190036:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
                "product": {
                  "name": "libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64 (squid:4)",
                  "product_id": "libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libecap-devel@1.0.1-2.module+el8.1.0+4044+36416a77?arch=x86_64\u0026rpmmod=squid:4:8000020221004190036:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4",
                "product": {
                  "name": "squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64 (squid:4)",
                  "product_id": "squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:squid-cache:squid:4.15:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/squid@4.15-1.module+el8.5.0+11469+24c223d9?arch=x86_64\u0026rpmmod=squid:4:8030020211110110418:rhel8\u0026epoch=7\u0026upstream=squid-7:4.15-1.module+el8.5.0+11469+24c223d9.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4"
        },
        "product_reference": "libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4"
        },
        "product_reference": "libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
        },
        "product_reference": "squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-28651",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-28651"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-28651",
          "url": "https://www.suse.com/security/cve/CVE-2021-28651"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185921 for CVE-2021-28651",
          "url": "https://bugzilla.suse.com/1185921"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-28651"
    },
    {
      "cve": "CVE-2021-28652",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-28652"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-28652",
          "url": "https://www.suse.com/security/cve/CVE-2021-28652"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185918 for CVE-2021-28652",
          "url": "https://bugzilla.suse.com/1185918"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-28652"
    },
    {
      "cve": "CVE-2021-28662",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-28662"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-28662",
          "url": "https://www.suse.com/security/cve/CVE-2021-28662"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185919 for CVE-2021-28662",
          "url": "https://bugzilla.suse.com/1185919"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-28662"
    },
    {
      "cve": "CVE-2021-31806",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-31806"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-31806",
          "url": "https://www.suse.com/security/cve/CVE-2021-31806"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185916 for CVE-2021-31806",
          "url": "https://bugzilla.suse.com/1185916"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-31806"
    },
    {
      "cve": "CVE-2021-31807",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-31807"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-31807",
          "url": "https://www.suse.com/security/cve/CVE-2021-31807"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185916 for CVE-2021-31807",
          "url": "https://bugzilla.suse.com/1185916"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216400 for CVE-2021-31807",
          "url": "https://bugzilla.suse.com/1216400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-31807"
    },
    {
      "cve": "CVE-2021-31808",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-31808"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-31808",
          "url": "https://www.suse.com/security/cve/CVE-2021-31808"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185916 for CVE-2021-31808",
          "url": "https://bugzilla.suse.com/1185916"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216399 for CVE-2021-31808",
          "url": "https://bugzilla.suse.com/1216399"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-31808"
    },
    {
      "cve": "CVE-2021-33620",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-33620"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
          "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-33620",
          "url": "https://www.suse.com/security/cve/CVE-2021-33620"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185923 for CVE-2021-33620",
          "url": "https://bugzilla.suse.com/1185923"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186654 for CVE-2021-33620",
          "url": "https://bugzilla.suse.com/1186654"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4",
            "SUSE Liberty Linux 8:squid-7:4.15-1.module+el8.5.0+11469+24c223d9.x86_64::squid:4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-33620"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.