csaf_redhat - rhsa-2023

rhsa-2023_7576

Vulnerability from csaf_redhat

Published

2023-11-29 13:51

Modified

2024-11-06 14:59

Summary

Red Hat Security Advisory: squid security update

Notes

Topic

An update for squid is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for squid is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:7576",
        "url": "https://access.redhat.com/errata/RHSA-2023:7576"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "2245916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7576.json"
      }
    ],
    "title": "Red Hat Security Advisory: squid security update",
    "tracking": {
      "current_release_date": "2024-11-06T14:59:05+00:00",
      "generator": {
        "date": "2024-11-06T14:59:05+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2023:7576",
      "initial_release_date": "2023-11-29T13:51:56+00:00",
      "revision_history": [
        {
          "date": "2023-11-29T13:51:56+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-11-29T13:51:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-06T14:59:05+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server AUS (v. 7.7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server AUS (v. 7.7)",
                  "product_id": "7Server-7.7.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_aus:7.7::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Optional AUS (v. 7.7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Optional AUS (v. 7.7)",
                  "product_id": "7Server-optional-7.7.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_aus:7.7::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squid-7:3.5.20-13.el7_7.1.src",
                "product": {
                  "name": "squid-7:3.5.20-13.el7_7.1.src",
                  "product_id": "squid-7:3.5.20-13.el7_7.1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid@3.5.20-13.el7_7.1?arch=src\u0026epoch=7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squid-7:3.5.20-13.el7_7.1.x86_64",
                "product": {
                  "name": "squid-7:3.5.20-13.el7_7.1.x86_64",
                  "product_id": "squid-7:3.5.20-13.el7_7.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid@3.5.20-13.el7_7.1?arch=x86_64\u0026epoch=7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
                "product": {
                  "name": "squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
                  "product_id": "squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid-migration-script@3.5.20-13.el7_7.1?arch=x86_64\u0026epoch=7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
                "product": {
                  "name": "squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
                  "product_id": "squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid-debuginfo@3.5.20-13.el7_7.1?arch=x86_64\u0026epoch=7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64",
                "product": {
                  "name": "squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64",
                  "product_id": "squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squid-sysvinit@3.5.20-13.el7_7.1?arch=x86_64\u0026epoch=7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.5.20-13.el7_7.1.src as a component of Red Hat Enterprise Linux Server AUS (v. 7.7)",
          "product_id": "7Server-7.7.AUS:squid-7:3.5.20-13.el7_7.1.src"
        },
        "product_reference": "squid-7:3.5.20-13.el7_7.1.src",
        "relates_to_product_reference": "7Server-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.5.20-13.el7_7.1.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.7)",
          "product_id": "7Server-7.7.AUS:squid-7:3.5.20-13.el7_7.1.x86_64"
        },
        "product_reference": "squid-7:3.5.20-13.el7_7.1.x86_64",
        "relates_to_product_reference": "7Server-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.7)",
          "product_id": "7Server-7.7.AUS:squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64"
        },
        "product_reference": "squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
        "relates_to_product_reference": "7Server-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-migration-script-7:3.5.20-13.el7_7.1.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.7)",
          "product_id": "7Server-7.7.AUS:squid-migration-script-7:3.5.20-13.el7_7.1.x86_64"
        },
        "product_reference": "squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
        "relates_to_product_reference": "7Server-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.7)",
          "product_id": "7Server-7.7.AUS:squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64"
        },
        "product_reference": "squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64",
        "relates_to_product_reference": "7Server-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.5.20-13.el7_7.1.src as a component of Red Hat Enterprise Linux Server Optional AUS (v. 7.7)",
          "product_id": "7Server-optional-7.7.AUS:squid-7:3.5.20-13.el7_7.1.src"
        },
        "product_reference": "squid-7:3.5.20-13.el7_7.1.src",
        "relates_to_product_reference": "7Server-optional-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-7:3.5.20-13.el7_7.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional AUS (v. 7.7)",
          "product_id": "7Server-optional-7.7.AUS:squid-7:3.5.20-13.el7_7.1.x86_64"
        },
        "product_reference": "squid-7:3.5.20-13.el7_7.1.x86_64",
        "relates_to_product_reference": "7Server-optional-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional AUS (v. 7.7)",
          "product_id": "7Server-optional-7.7.AUS:squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64"
        },
        "product_reference": "squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
        "relates_to_product_reference": "7Server-optional-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-migration-script-7:3.5.20-13.el7_7.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional AUS (v. 7.7)",
          "product_id": "7Server-optional-7.7.AUS:squid-migration-script-7:3.5.20-13.el7_7.1.x86_64"
        },
        "product_reference": "squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
        "relates_to_product_reference": "7Server-optional-7.7.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional AUS (v. 7.7)",
          "product_id": "7Server-optional-7.7.AUS:squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64"
        },
        "product_reference": "squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64",
        "relates_to_product_reference": "7Server-optional-7.7.AUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-46847",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2023-10-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2245916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Squid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "squid: Denial of Service in HTTP Digest Authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-7.7.AUS:squid-7:3.5.20-13.el7_7.1.src",
          "7Server-7.7.AUS:squid-7:3.5.20-13.el7_7.1.x86_64",
          "7Server-7.7.AUS:squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
          "7Server-7.7.AUS:squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
          "7Server-7.7.AUS:squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64",
          "7Server-optional-7.7.AUS:squid-7:3.5.20-13.el7_7.1.src",
          "7Server-optional-7.7.AUS:squid-7:3.5.20-13.el7_7.1.x86_64",
          "7Server-optional-7.7.AUS:squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
          "7Server-optional-7.7.AUS:squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
          "7Server-optional-7.7.AUS:squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-46847"
        },
        {
          "category": "external",
          "summary": "RHBZ#2245916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-46847",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-46847"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-46847",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46847"
        },
        {
          "category": "external",
          "summary": "https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g",
          "url": "https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g"
        }
      ],
      "release_date": "2023-10-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-11-29T13:51:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, the squid service will be restarted automatically.",
          "product_ids": [
            "7Server-7.7.AUS:squid-7:3.5.20-13.el7_7.1.src",
            "7Server-7.7.AUS:squid-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-7.7.AUS:squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-7.7.AUS:squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-7.7.AUS:squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-optional-7.7.AUS:squid-7:3.5.20-13.el7_7.1.src",
            "7Server-optional-7.7.AUS:squid-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-optional-7.7.AUS:squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-optional-7.7.AUS:squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-optional-7.7.AUS:squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:7576"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-7.7.AUS:squid-7:3.5.20-13.el7_7.1.src",
            "7Server-7.7.AUS:squid-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-7.7.AUS:squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-7.7.AUS:squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-7.7.AUS:squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-optional-7.7.AUS:squid-7:3.5.20-13.el7_7.1.src",
            "7Server-optional-7.7.AUS:squid-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-optional-7.7.AUS:squid-debuginfo-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-optional-7.7.AUS:squid-migration-script-7:3.5.20-13.el7_7.1.x86_64",
            "7Server-optional-7.7.AUS:squid-sysvinit-7:3.5.20-13.el7_7.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "squid: Denial of Service in HTTP Digest Authentication"
    }
  ]
}

cve-2023-46847

Vulnerability from cvelistv5

Published

2023-11-03 07:58

Modified

2024-11-06 14:44

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Summary

Squid: denial of service in http digest authentication

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2023:6266	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6267	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6268	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6748	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6801	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6803	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6804	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6805	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6810	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6882	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:6884	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7213	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7576	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7578	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-46847	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2245916	issue-tracking, x_refsource_REDHAT
	https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g

Impacted products

▼	Vendor	Product

	Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support
	Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support
	Red Hat	Red Hat Enterprise Linux 7
	Red Hat	Red Hat Enterprise Linux 7.6 Advanced Update Support
	Red Hat	Red Hat Enterprise Linux 7.7 Advanced Update Support
	Red Hat	Red Hat Enterprise Linux 8
	Red Hat	Red Hat Enterprise Linux 8
	Red Hat	Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
	Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support
	Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service
	Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
	Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
	Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service
	Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
	Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support
	Red Hat	Red Hat Enterprise Linux 9
	Red Hat	Red Hat Enterprise Linux 9
	Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:53:21.999Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2023:6266",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6266"
          },
          {
            "name": "RHSA-2023:6267",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6267"
          },
          {
            "name": "RHSA-2023:6268",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6268"
          },
          {
            "name": "RHSA-2023:6748",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6748"
          },
          {
            "name": "RHSA-2023:6801",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6801"
          },
          {
            "name": "RHSA-2023:6803",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6803"
          },
          {
            "name": "RHSA-2023:6804",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6804"
          },
          {
            "name": "RHSA-2023:6805",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6805"
          },
          {
            "name": "RHSA-2023:6810",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6810"
          },
          {
            "name": "RHSA-2023:6882",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6882"
          },
          {
            "name": "RHSA-2023:6884",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:6884"
          },
          {
            "name": "RHSA-2023:7213",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:7213"
          },
          {
            "name": "RHSA-2023:7576",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:7576"
          },
          {
            "name": "RHSA-2023:7578",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:7578"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2023-46847"
          },
          {
            "name": "RHBZ#2245916",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245916"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231130-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/squid-cache/squid",
          "defaultStatus": "unaffected",
          "packageName": "squid",
          "versions": [
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "3.2.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "affected",
          "packageName": "squid34",
          "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7:3.4.14-15.el6_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "affected",
          "packageName": "squid",
          "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7:3.1.23-24.el6_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7::workstation",
            "cpe:/o:redhat:enterprise_linux:7::server"
          ],
          "defaultStatus": "affected",
          "packageName": "squid",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7:3.5.20-17.el7_9.9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:7.6::server"
          ],
          "defaultStatus": "affected",
          "packageName": "squid",
          "product": "Red Hat Enterprise Linux 7.6 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7:3.5.20-12.el7_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:7.7::server"
          ],
          "defaultStatus": "affected",
          "packageName": "squid",
          "product": "Red Hat Enterprise Linux 7.7 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7:3.5.20-13.el7_7.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020231030214932.63b34585",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8090020231030224841.a75119d5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.1::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8010020231101141358.c27ad7f8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_tus:8.2::appstream",
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8020020231101135052.4cda2c84",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_tus:8.2::appstream",
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8020020231101135052.4cda2c84",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_tus:8.2::appstream",
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8020020231101135052.4cda2c84",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020231101101624.522a0ee4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020231101101624.522a0ee4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8040020231101101624.522a0ee4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid:4",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020231031165747.ad008a3a",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7:5.5-5.el9_2.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7:5.5-6.el9_3.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "squid",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7:5.2-1.el9_0.3",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2023-10-19T00:00:00+00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Squid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Critical"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T14:44:14.392Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2023:6266",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6266"
        },
        {
          "name": "RHSA-2023:6267",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6267"
        },
        {
          "name": "RHSA-2023:6268",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6268"
        },
        {
          "name": "RHSA-2023:6748",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6748"
        },
        {
          "name": "RHSA-2023:6801",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6801"
        },
        {
          "name": "RHSA-2023:6803",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6803"
        },
        {
          "name": "RHSA-2023:6804",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6804"
        },
        {
          "name": "RHSA-2023:6805",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6805"
        },
        {
          "name": "RHSA-2023:6810",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6810"
        },
        {
          "name": "RHSA-2023:6882",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6882"
        },
        {
          "name": "RHSA-2023:6884",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:6884"
        },
        {
          "name": "RHSA-2023:7213",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:7213"
        },
        {
          "name": "RHSA-2023:7576",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:7576"
        },
        {
          "name": "RHSA-2023:7578",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:7578"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2023-46847"
        },
        {
          "name": "RHBZ#2245916",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245916"
        },
        {
          "url": "https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-10-24T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2023-10-19T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Squid: denial of service in http digest authentication",
      "x_redhatCweChain": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-46847",
    "datePublished": "2023-11-03T07:58:05.641Z",
    "dateReserved": "2023-10-27T08:36:38.158Z",
    "dateUpdated": "2024-11-06T14:44:14.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted