Bug 1962254 (CVE-2021-28662)
Summary: | CVE-2021-28662 squid: denial of service in HTTP response processing | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | anon.amish, code, icesalov, jonathansteffan, luhliari |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | squid 4.15, squid 5.0.6 | Doc Type: | If docs needed, set a value |
Doc Text: |
An input validation flaw was found in Squid. This issue could allow a remote server to perform a denial of service against all clients using the proxy when delivering HTTP response messages. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-11-09 18:54:14 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1963381, 1963382, 1963383 | ||
Bug Blocks: | 1959539 |
Description
Mauro Matteo Cascella
2021-05-19 15:18:58 UTC
Created squid tracking bugs for this issue: Affects: fedora-all [bug 1963381] Upstream commits: https://github.com/squid-cache/squid/commit/051824924c709bd6162a378f746fb859454c674e [master] https://github.com/squid-cache/squid/commit/d09b34de2575af3bab4b34c775f93acb7270b4c3 [v5] https://github.com/squid-cache/squid/commit/b1c37c9e7b30d0efb5e5ccf8200f2a646b9c36f8 [v4] The supported versions of Red Hat Satellite does not ship Squid and only consumed through Red Hat Enterprise Linux repository. Product uses older version Squid which is not affected by vulnerability. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4292 https://access.redhat.com/errata/RHSA-2021:4292 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-28662 |