CVE-2023-49285
Assigner: GitHub_M
Published: 2023-12-04T22:56:55.105Z
State: PUBLISHED
title: Denial of Service in HTTP Message Processing in Squid
problemTypes: descriptions: cweId: CWE-126
description: CWE-126: Buffer Over-read
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
affected: vendor: squid-cache
product: squid
versions: version: >= 2.2, < 6.5
status: affected
descriptions: value: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
source: advisory: GHSA-8w9r-p88v-mmx9
discovery: UNKNOWN