[3.7] squid: Multiple vulnerabilities (CVE-2018-1000024, CVE-2018-1000027)
CVE-2018-1000024: Incorrect pointer handling when processing ESI Responses can lead to denial of service
Due to incorrect pointer handling, Squid versions 3.x (prior to 3.5.27)
and 4.x (prior to 4.0.23) are vulnerable to
a denial of service attack when processing ESI responses. This problem
allows a remote server delivering certain
ESI response syntax to trigger a denial of service for all clients
accessing the Squid service.
Fixed In Version:
squid 3.5.27, squid 4.0.23
References:
http://www.squid-cache.org/Advisories/SQUID-2018\_1.txt
Patch:
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018\_1.patch
CVE-2018-1000027: Incorrect pointer handling in HTTP processing and certificate download can lead to denial of service
Due to incorrect pointer handling, Squid versions 3.x (prior to 3.5.27)
and 4.x (prior to 4.0.23) are vulnerable to a denial of service attack
when processing
HTTP messages or downloading intermediate CA certificates. This problem
allows a remote client delivering certain HTTP requests in conjunction
with
certain trusted server responses to trigger a denial of service for all
clients accessing the Squid service.
Fixed In Version:
squid 3.5.27, squid 4.0.23
References:
http://www.squid-cache.org/Advisories/SQUID-2018\_2.txt
Patch:
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018\_2.patch
(from redmine: issue id 8551, created on 2018-02-23, closed on 2018-03-05)
- Relations:
- parent #8549 (closed)
- Changesets:
- Revision 8a619d8d on 2018-02-28T13:17:04Z:
main/squid: security upgrade to 3.5.27
CVE-2018-1000024, CVE-2018-1000027
Fixes #8551