Bug 2010685 (CVE-2021-41611)

Summary:	CVE-2021-41611 squid: improper certificate validation
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anon.amish, code, jonathansteffan, luhliari
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	squid 5.2	Doc Type:	If docs needed, set a value
Doc Text:	The squid proxy package may incorrectly classify certain certificates as trusted. This can allow traffic to obtain security trust when the trust is not valid. The highest threat from this vulnerability is to confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-04-18 00:27:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2010686, 2011031
Bug Blocks:	2010687

Description Marian Rehak 2021-10-05 10:57:32 UTC

A remote server can obtain security trust even if the trust is not valid, when multiple CAs have signed the TLS server certificate or in cases
of broken server certificate chains. This indication of trust may be passed along to clients allowing access to unsafe or hijacked services.

Upstream Advisory:

https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r

Comment 1 Marian Rehak 2021-10-05 10:57:47 UTC

Created squid tracking bugs for this issue:

Affects: fedora-all [bug 2010686]

Comment 3 devthomp 2021-10-06 13:11:52 UTC

Patch:
http://www.squid-cache.org/Versions/v5/changesets/squid-5-533b4359f16cf9ed15a6d709a57a4b06e4222cfe.patch

Comment 4 Product Security DevOps Team 2022-04-18 00:27:48 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-41611