Bug 2283380 (CVE-2024-33427)

Summary:	CVE-2024-33427 squid: buffer overread leading to denial of service
Product:	[Other] Security Response	Reporter:	ybuenos
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Squid. A buffer over-read in the ConfigParser::UnQuote function in the src/ConfigParser.cc file can be triggered when a specially crafted configuration file is being parsed by Squid when it's initializing, causing an application crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-05-28 17:34:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2283383, 2283382, 2283384
Bug Blocks:	2283385

Description ybuenos 2024-05-27 09:24:34 UTC

Buffer Overflow vulnerability in Squid version before v.6.10 allows a local attacker cause a denial of service via a improper check of string in function ConfigParser::UnQuote.

Reference:
https://github.com/squid-cache/squid/pull/1763

Comment 1 ybuenos 2024-05-27 09:28:25 UTC

Created clustal-omega tracking bugs for this issue:

Affects: epel-all [bug 2283383]
Affects: fedora-all [bug 2283384]


Created squid tracking bugs for this issue:

Affects: fedora-all [bug 2283382]

Comment 3 Guilherme de Almeida Suckevicz 2024-05-28 17:34:11 UTC

This CVE has been rejected because it was not considered a security vulnerability.

References:
https://www.cve.org/CVERecord?id=CVE-2024-33427
https://nvd.nist.gov/vuln/detail/CVE-2024-33427