jiachao2130/cvrf2cusa
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
d1132d88d2
cvrf2cusa/cvrf/2023/cvrf-openEuler-SA-2023-1794.xml
Jia Chao 0b34274085 git mv 
Signed-off-by: Jia Chao <jiac13@chinaunicom.cn>
2024-07-25 09:57:37 +08:00

176 lines
14 KiB
XML
Raw Blame History

<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
<DocumentTitle xml:lang="en">An update for squid is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2</DocumentTitle>
<DocumentType>Security Advisory</DocumentType>
<DocumentPublisher Type="Vendor">
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
<IssuingAuthority>openEuler security committee</IssuingAuthority>
</DocumentPublisher>
<DocumentTracking>
<Identification>
<ID>openEuler-SA-2023-1794</ID>
</Identification>
<Status>Final</Status>
<Version>1.0</Version>
<RevisionHistory>
<Revision>
<Number>1.0</Number>
<Date>2023-11-10</Date>
<Description>Initial</Description>
</Revision>
</RevisionHistory>
<InitialReleaseDate>2023-11-10</InitialReleaseDate>
<CurrentReleaseDate>2023-11-10</CurrentReleaseDate>
<Generator>
<Engine>openEuler SA Tool V1.0</Engine>
<Date>2023-11-10</Date>
</Generator>
</DocumentTracking>
<DocumentNotes>
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">squid security update</Note>
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for squid is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2.</Note>
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.
Security Fix(es):
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid&apos;s patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.(CVE-2023-46724)
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid&apos;s Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.(CVE-2023-46728)</Note>
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for squid is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">squid</Note>
</DocumentNotes>
<DocumentReferences>
<Reference Type="Self">
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1794</URL>
</Reference>
<Reference Type="openEuler CVE">
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-46724</URL>
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-46728</URL>
</Reference>
<Reference Type="Other">
<URL>https://nvd.nist.gov/vuln/detail/CVE-2023-46724</URL>
<URL>https://nvd.nist.gov/vuln/detail/CVE-2023-46728</URL>
</Reference>
</DocumentReferences>
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
<Branch Type="Product Name" Name="openEuler">
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
<FullProductName ProductID="openEuler-20.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">openEuler-20.03-LTS-SP3</FullProductName>
<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
<FullProductName ProductID="openEuler-22.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">openEuler-22.03-LTS-SP1</FullProductName>
<FullProductName ProductID="openEuler-22.03-LTS-SP2" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">openEuler-22.03-LTS-SP2</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="aarch64">
<FullProductName ProductID="squid-debuginfo-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">squid-debuginfo-4.9-16.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">squid-debugsource-4.9-16.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">squid-4.9-16.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">squid-4.9-16.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">squid-debuginfo-4.9-16.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">squid-debugsource-4.9-16.oe1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">squid-debugsource-4.9-20.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">squid-4.9-20.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">squid-debuginfo-4.9-20.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">squid-4.9-20.oe2203sp1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">squid-debugsource-4.9-20.oe2203sp1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">squid-debuginfo-4.9-20.oe2203sp1.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">squid-debuginfo-4.9-20.oe2203sp2.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">squid-4.9-20.oe2203sp2.aarch64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">squid-debugsource-4.9-20.oe2203sp2.aarch64.rpm</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="src">
<FullProductName ProductID="squid-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">squid-4.9-16.oe1.src.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">squid-4.9-16.oe1.src.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">squid-4.9-20.oe2203.src.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">squid-4.9-20.oe2203sp1.src.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">squid-4.9-20.oe2203sp2.src.rpm</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="x86_64">
<FullProductName ProductID="squid-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">squid-4.9-16.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">squid-debugsource-4.9-16.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">squid-debuginfo-4.9-16.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">squid-4.9-16.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">squid-debuginfo-4.9-16.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-16" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">squid-debugsource-4.9-16.oe1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">squid-4.9-20.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">squid-debugsource-4.9-20.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">squid-debuginfo-4.9-20.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">squid-debugsource-4.9-20.oe2203sp1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">squid-debuginfo-4.9-20.oe2203sp1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">squid-4.9-20.oe2203sp1.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">squid-4.9-20.oe2203sp2.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debugsource-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">squid-debugsource-4.9-20.oe2203sp2.x86_64.rpm</FullProductName>
<FullProductName ProductID="squid-debuginfo-4.9-20" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">squid-debuginfo-4.9-20.oe2203sp2.x86_64.rpm</FullProductName>
</Branch>
</ProductTree>
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
<Notes>
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid s patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.</Note>
</Notes>
<ReleaseDate>2023-11-10</ReleaseDate>
<CVE>CVE-2023-46724</CVE>
<ProductStatuses>
<Status Type="Fixed">
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
<ProductID>openEuler-22.03-LTS</ProductID>
<ProductID>openEuler-22.03-LTS-SP1</ProductID>
<ProductID>openEuler-22.03-LTS-SP2</ProductID>
</Status>
</ProductStatuses>
<Threats>
<Threat Type="Impact">
<Description>High</Description>
</Threat>
</Threats>
<CVSSScoreSets>
<ScoreSet>
<BaseScore>8.6</BaseScore>
<Vector>AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H</Vector>
</ScoreSet>
</CVSSScoreSets>
<Remediations>
<Remediation Type="Vendor Fix">
<Description>squid security update</Description>
<DATE>2023-11-10</DATE>
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1794</URL>
</Remediation>
</Remediations>
</Vulnerability>
<Vulnerability Ordinal="2" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
<Notes>
<Note Title="Vulnerability Description" Type="General" Ordinal="2" xml:lang="en">Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid s Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.</Note>
</Notes>
<ReleaseDate>2023-11-10</ReleaseDate>
<CVE>CVE-2023-46728</CVE>
<ProductStatuses>
<Status Type="Fixed">
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
<ProductID>openEuler-22.03-LTS</ProductID>
<ProductID>openEuler-22.03-LTS-SP1</ProductID>
<ProductID>openEuler-22.03-LTS-SP2</ProductID>
</Status>
</ProductStatuses>
<Threats>
<Threat Type="Impact">
<Description>High</Description>
</Threat>
</Threats>
<CVSSScoreSets>
<ScoreSet>
<BaseScore>7.5</BaseScore>
<Vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</Vector>
</ScoreSet>
</CVSSScoreSets>
<Remediations>
<Remediation Type="Vendor Fix">
<Description>squid security update</Description>
<DATE>2023-11-10</DATE>
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1794</URL>
</Remediation>
</Remediations>
</Vulnerability>
</cvrfdoc>
Reference in New Issue View Git Blame Copy Permalink