CVE-2023-46846

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-46846
SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:6266 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6267 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6268 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6748 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6801 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6803 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6804 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6810 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7213 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-46846 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2245910 Issue Tracking Third Party Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:9.2:*:*:*:*:*:*:*
History

16 Sep 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html', 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/01/msg00008.html', 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20231130-0002/', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}

22 Jan 2024, 20:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/01/msg00008.html -

09 Jan 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html -

28 Dec 2023, 16:24

Type Values Removed Values Added
CPE cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
References () https://security.netapp.com/advisory/ntap-20231130-0002/ - () https://security.netapp.com/advisory/ntap-20231130-0002/ - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7213 - () https://access.redhat.com/errata/RHSA-2023:7213 - Third Party Advisory
First Time Redhat enterprise Linux For Arm 64
Redhat enterprise Linux For Ibm Z Systems
Redhat enterprise Linux For Power Little Endian

30 Nov 2023, 22:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20231130-0002/ -

14 Nov 2023, 21:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7213 -

13 Nov 2023, 20:02

Type Values Removed Values Added
CWE CWE-444
First Time Squid-cache
Squid-cache squid
Redhat
Redhat enterprise Linux Server Aus
Redhat enterprise Linux Server Tus
Redhat enterprise Linux
Redhat enterprise Linux Eus
References (MISC) https://access.redhat.com/errata/RHSA-2023:6268 - (MISC) https://access.redhat.com/errata/RHSA-2023:6268 - Third Party Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:6266 - (MISC) https://access.redhat.com/errata/RHSA-2023:6266 - Third Party Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:6267 - (MISC) https://access.redhat.com/errata/RHSA-2023:6267 - Third Party Advisory
References (MISC) https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh - (MISC) https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh - Vendor Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2245910 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2245910 - Issue Tracking, Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2023-46846 - (MISC) https://access.redhat.com/security/cve/CVE-2023-46846 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6804 - () https://access.redhat.com/errata/RHSA-2023:6804 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6810 - () https://access.redhat.com/errata/RHSA-2023:6810 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6748 - () https://access.redhat.com/errata/RHSA-2023:6748 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6801 - () https://access.redhat.com/errata/RHSA-2023:6801 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6803 - () https://access.redhat.com/errata/RHSA-2023:6803 - Third Party Advisory
CPE cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

08 Nov 2023, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:6801 -
  • () https://access.redhat.com/errata/RHSA-2023:6803 -
  • () https://access.redhat.com/errata/RHSA-2023:6810 -
  • () https://access.redhat.com/errata/RHSA-2023:6804 -

07 Nov 2023, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:6748 -

03 Nov 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-03 08:15

Updated : 2024-09-16 16:15

NVD link : CVE-2023-46846

Mitre link : CVE-2023-46846

CVE.ORG link : CVE-2023-46846

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • enterprise_linux_for_arm_64
  • enterprise_linux_for_ibm_z_systems
  • enterprise_linux_server_aus
  • enterprise_linux_eus
  • enterprise_linux_server_tus
  • enterprise_linux_for_power_little_endian

squid-cache

  • squid
CWE
CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024