Vulnerability Description
The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Squid-Cache | Squid | >= 3.0, <= 3.5.27 |
| Debian | Debian Linux | 7.0 |
| Canonical | Ubuntu Linux | 14.04 |
References
- http://www.squid-cache.org/Advisories/SQUID-2018_1.txtPatchVendor Advisory
- http://www.squid-cache.org/Versions/Release NotesVendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/02/msg00001.htmlMailing ListThird Party Advisory
- https://usn.ubuntu.com/3557-1/Third Party Advisory
- https://usn.ubuntu.com/4059-2/
- https://www.debian.org/security/2018/dsa-4122Third Party Advisory
- http://www.squid-cache.org/Advisories/SQUID-2018_1.txtPatchVendor Advisory
- http://www.squid-cache.org/Versions/Release NotesVendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/02/msg00001.htmlMailing ListThird Party Advisory
- https://usn.ubuntu.com/3557-1/Third Party Advisory
- https://usn.ubuntu.com/4059-2/
- https://www.debian.org/security/2018/dsa-4122Third Party Advisory
FAQ
What is CVE-2018-1000024?
CVE-2018-1000024 is a vulnerability with a CVSS score of 7.5 (HIGH). The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of ...
How severe is CVE-2018-1000024?
CVE-2018-1000024 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1000024?
Check the references section above for vendor advisories and patch information. Affected products include: Squid-Cache Squid, Debian Debian Linux, Canonical Ubuntu Linux.