An update for squid is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2023-1794 Final 1.0 1.0 2023-11-10 Initial 2023-11-10 2023-11-10 openEuler SA Tool V1.0 2023-11-10 squid security update An update for squid is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2. Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fix(es): Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.(CVE-2023-46724) Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.(CVE-2023-46728) An update for squid is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High squid https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1794 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-46724 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-46728 https://nvd.nist.gov/vuln/detail/CVE-2023-46724 https://nvd.nist.gov/vuln/detail/CVE-2023-46728 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS openEuler-22.03-LTS-SP1 openEuler-22.03-LTS-SP2 squid-debuginfo-4.9-16.oe1.aarch64.rpm squid-debugsource-4.9-16.oe1.aarch64.rpm squid-4.9-16.oe1.aarch64.rpm squid-4.9-16.oe1.aarch64.rpm squid-debuginfo-4.9-16.oe1.aarch64.rpm squid-debugsource-4.9-16.oe1.aarch64.rpm squid-debugsource-4.9-20.oe2203.aarch64.rpm squid-4.9-20.oe2203.aarch64.rpm squid-debuginfo-4.9-20.oe2203.aarch64.rpm squid-4.9-20.oe2203sp1.aarch64.rpm squid-debugsource-4.9-20.oe2203sp1.aarch64.rpm squid-debuginfo-4.9-20.oe2203sp1.aarch64.rpm squid-debuginfo-4.9-20.oe2203sp2.aarch64.rpm squid-4.9-20.oe2203sp2.aarch64.rpm squid-debugsource-4.9-20.oe2203sp2.aarch64.rpm squid-4.9-16.oe1.src.rpm squid-4.9-16.oe1.src.rpm squid-4.9-20.oe2203.src.rpm squid-4.9-20.oe2203sp1.src.rpm squid-4.9-20.oe2203sp2.src.rpm squid-4.9-16.oe1.x86_64.rpm squid-debugsource-4.9-16.oe1.x86_64.rpm squid-debuginfo-4.9-16.oe1.x86_64.rpm squid-4.9-16.oe1.x86_64.rpm squid-debuginfo-4.9-16.oe1.x86_64.rpm squid-debugsource-4.9-16.oe1.x86_64.rpm squid-4.9-20.oe2203.x86_64.rpm squid-debugsource-4.9-20.oe2203.x86_64.rpm squid-debuginfo-4.9-20.oe2203.x86_64.rpm squid-debugsource-4.9-20.oe2203sp1.x86_64.rpm squid-debuginfo-4.9-20.oe2203sp1.x86_64.rpm squid-4.9-20.oe2203sp1.x86_64.rpm squid-4.9-20.oe2203sp2.x86_64.rpm squid-debugsource-4.9-20.oe2203sp2.x86_64.rpm squid-debuginfo-4.9-20.oe2203sp2.x86_64.rpm Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid s patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages. 2023-11-10 CVE-2023-46724 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS openEuler-22.03-LTS-SP1 openEuler-22.03-LTS-SP2 High 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H squid security update 2023-11-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1794 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid s Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests. 2023-11-10 CVE-2023-46728 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS openEuler-22.03-LTS-SP1 openEuler-22.03-LTS-SP2 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H squid security update 2023-11-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1794