An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
References
Link | Resource |
---|---|
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch | Patch Vendor Advisory |
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patch | Patch Vendor Advisory |
https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq | Mitigation Patch Third Party Advisory |
https://www.openwall.com/lists/oss-security/2022/09/23/1 | Mailing List Mitigation Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:22
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-697 |
Information
Published : 2022-12-25 19:15
Updated : 2024-02-28 19:51
NVD link : CVE-2022-41317
Mitre link : CVE-2022-41317
CVE.ORG link : CVE-2022-41317
JSON object : View
Products Affected
squid-cache
- squid
CWE
CWE-697
Incorrect Comparison