CVE-2023-46847

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-46847
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:6266 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6267 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6268 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6748 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6801 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6803 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6804 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6805 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6810 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6882 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6884 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7213 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7576 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7578 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-46847 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2245916 Issue Tracking Third Party Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
History

16 Sep 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20231130-0002/', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}

16 Feb 2024, 15:22

Type Values Removed Values Added
First Time Redhat enterprise Linux For Ibm Z Systems
Redhat enterprise Linux For Arm 64
Redhat enterprise Linux For Power Little Endian
CPE cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
References () https://access.redhat.com/errata/RHSA-2023:7213 - () https://access.redhat.com/errata/RHSA-2023:7213 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20231130-0002/ - () https://security.netapp.com/advisory/ntap-20231130-0002/ - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7578 - () https://access.redhat.com/errata/RHSA-2023:7578 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7576 - () https://access.redhat.com/errata/RHSA-2023:7576 - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html - () https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html - Mailing List, Third Party Advisory

09 Jan 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html -

30 Nov 2023, 22:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20231130-0002/ -

29 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7576 -
  • () https://access.redhat.com/errata/RHSA-2023:7578 -

14 Nov 2023, 21:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7213 -

13 Nov 2023, 20:03

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:6884 - () https://access.redhat.com/errata/RHSA-2023:6884 - Third Party Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:6268 - (MISC) https://access.redhat.com/errata/RHSA-2023:6268 - Third Party Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:6266 - (MISC) https://access.redhat.com/errata/RHSA-2023:6266 - Third Party Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:6267 - (MISC) https://access.redhat.com/errata/RHSA-2023:6267 - Third Party Advisory
References (MISC) https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g - (MISC) https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:6882 - () https://access.redhat.com/errata/RHSA-2023:6882 - Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2023-46847 - (MISC) https://access.redhat.com/security/cve/CVE-2023-46847 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6805 - () https://access.redhat.com/errata/RHSA-2023:6805 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6804 - () https://access.redhat.com/errata/RHSA-2023:6804 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6810 - () https://access.redhat.com/errata/RHSA-2023:6810 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6748 - () https://access.redhat.com/errata/RHSA-2023:6748 - Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2245916 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2245916 - Issue Tracking, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6801 - () https://access.redhat.com/errata/RHSA-2023:6801 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6803 - () https://access.redhat.com/errata/RHSA-2023:6803 - Third Party Advisory
First Time Redhat enterprise Linux Server
Squid-cache
Redhat
Redhat enterprise Linux Eus
Redhat enterprise Linux Workstation
Squid-cache squid
Redhat enterprise Linux Server Aus
Redhat enterprise Linux Server Tus
Redhat enterprise Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-120
CPE cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*

13 Nov 2023, 12:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:6884 -
  • () https://access.redhat.com/errata/RHSA-2023:6882 -

08 Nov 2023, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:6803 -
  • () https://access.redhat.com/errata/RHSA-2023:6804 -
  • () https://access.redhat.com/errata/RHSA-2023:6805 -
  • () https://access.redhat.com/errata/RHSA-2023:6810 -
  • () https://access.redhat.com/errata/RHSA-2023:6801 -

07 Nov 2023, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:6748 -

03 Nov 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-03 08:15

Updated : 2024-09-16 16:15

NVD link : CVE-2023-46847

Mitre link : CVE-2023-46847

CVE.ORG link : CVE-2023-46847

JSON object : View

Products Affected

redhat

  • enterprise_linux_server
  • enterprise_linux
  • enterprise_linux_for_arm_64
  • enterprise_linux_for_ibm_z_systems
  • enterprise_linux_server_aus
  • enterprise_linux_eus
  • enterprise_linux_server_tus
  • enterprise_linux_workstation
  • enterprise_linux_for_power_little_endian

squid-cache

  • squid
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024