Vulnerability Description
Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Squid-Cache | Squid | >= 3.0, < 4.13 |
| Canonical | Ubuntu Linux | 16.04 |
| Debian | Debian Linux | 9.0 |
| Fedoraproject | Fedora | 31 |
| Opensuse | Leap | 15.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.htmlMailing ListThird Party Advisory
- http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patchPatchVendor Advisory
- https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jgThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/10/msg00005.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20210219-0007/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210226-0006/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210226-0007/Broken Link
- https://usn.ubuntu.com/4477-1/Third Party Advisory
- https://usn.ubuntu.com/4551-1/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4751Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2020-24606?
CVE-2020-24606 is a vulnerability with a CVSS score of 8.6 (HIGH). Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only oc...
How severe is CVE-2020-24606?
CVE-2020-24606 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-24606?
Check the references section above for vendor advisories and patch information. Affected products include: Squid-Cache Squid, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap.