Bugzilla – Bug 1175671
VUL-0: CVE-2020-24606: squid: Denial of Service processing Cache Digest Response (SQUID-2020:9)
Last modified: 2022-10-18 09:38:13 UTC
Problem Description: Due to Improper Input Validation Squid is vulnerable to a Denial of Service attack against the machine operating Squid. Severity: This problem allows a trusted peer to deliver to perform Denial of Service by consuming all available CPU cycles on the machine running Squid when handling a crafted Cache Digest response message. This attack is limited to Squid using cache_peer with cache digests feature. CVSS Score of 9.5 https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:H/RL:O/RC:C/CR:X/IR:X/AR:H/MAV:N/MAC:L/MPR:X/MUI:N/MS:C/MC:N/MI:N/MA:H&version=3.1 Updated Packages: This bug is fixed by Squid versions 4.13 and 5.0.4. In addition, patches addressing this problem for the stable releases can be found in our patch archives: Squid 4: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patch If you are using a prepackaged version of Squid then please refer to the package vendor for availability information on updated packages. Determining if your version is vulnerable: All Squid built using --disable-cache-digests are not vulnerable. All Squid without cache_peer directives configured are not vulnerable. All Squid-3.x up to and including 3.5.28 using cache_peer directives with no-digest option configured are not vulnerable. All Squid-3.x up to and including 3.5.28 using cache_peer directives without the no-digest option configured are vulnerable. All Squid-4.x up to and including 4.12 using cache_peer directives with no-digest option configured are not vulnerable. All Squid-4.x up to and including 4.12 using cache_peer directives without the no-digest option configured are vulnerable. All Squid-5.x up to and including 5.0.3 using cache_peer directives with no-digest option configured are not vulnerable. All Squid-5.x up to and including 5.0.3 using cache_peer directives without the no-digest option configured are vulnerable. Workaround: Either, Add the no-digest option to all cache_peer lines in squid.conf Or, Build Squid with --disable-cache-digests Credits: This vulnerability was discovered by Lubos Uhliarik of RedHat. Fixed by Eduard Bagdasaryan (The Measurement Factory). References: https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg
This is an autogenerated message for OBS integration: This bug (1175671) was mentioned in https://build.opensuse.org/request/show/828922 Factory / squid
SUSE-SU-2020:2442-1: An update that fixes four vulnerabilities is now available. Category: security (critical) Bug References: 1173455,1175664,1175665,1175671 CVE References: CVE-2020-15049,CVE-2020-15810,CVE-2020-15811,CVE-2020-24606 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): squid-4.13-5.23.1 SUSE Linux Enterprise Server 15-LTSS (src): squid-4.13-5.23.1 SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): squid-4.13-5.23.1 SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): squid-4.13-5.23.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): squid-4.13-5.23.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): squid-4.13-5.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2443-1: An update that fixes four vulnerabilities is now available. Category: security (critical) Bug References: 1173455,1175664,1175665,1175671 CVE References: CVE-2020-15049,CVE-2020-15810,CVE-2020-15811,CVE-2020-24606 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP5 (src): squid-4.13-4.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2471-1: An update that fixes three vulnerabilities is now available. Category: security (critical) Bug References: 1175664,1175665,1175671 CVE References: CVE-2020-15810,CVE-2020-15811,CVE-2020-24606 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): squid-3.5.21-26.32.1 SUSE OpenStack Cloud Crowbar 8 (src): squid-3.5.21-26.32.1 SUSE OpenStack Cloud 9 (src): squid-3.5.21-26.32.1 SUSE OpenStack Cloud 8 (src): squid-3.5.21-26.32.1 SUSE OpenStack Cloud 7 (src): squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): squid-3.5.21-26.32.1 SUSE Enterprise Storage 5 (src): squid-3.5.21-26.32.1 HPE Helion Openstack 8 (src): squid-3.5.21-26.32.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1346-1: An update that fixes four vulnerabilities is now available. Category: security (critical) Bug References: 1173455,1175664,1175665,1175671 CVE References: CVE-2020-15049,CVE-2020-15810,CVE-2020-15811,CVE-2020-24606 JIRA References: Sources used: openSUSE Leap 15.1 (src): squid-4.13-lp151.2.24.1
openSUSE-SU-2020:1369-1: An update that fixes four vulnerabilities is now available. Category: security (critical) Bug References: 1173455,1175664,1175665,1175671 CVE References: CVE-2020-15049,CVE-2020-15810,CVE-2020-15811,CVE-2020-24606 JIRA References: Sources used: openSUSE Leap 15.2 (src): squid-4.13-lp152.2.6.1
SUSE-SU-2020:14590-1: An update that fixes three vulnerabilities is now available. Category: security (critical) Bug References: 1175664,1175665,1175671 CVE References: CVE-2020-15810,CVE-2020-15811,CVE-2020-24606 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): squid3-3.1.23-8.16.37.15.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): squid3-3.1.23-8.16.37.15.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): squid3-3.1.23-8.16.37.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Fixes should be submitted to all active codestreams. Reassigning to security-team.