Due to incorrectly handling server errors Squid is vulnerable to a denial of service attack when connecting to TLS or SSL servers. This problem allows any trusted client to perform a denial of service attack on the Squid service regardless of whether TLS or SSL is configured for use in the proxy. Upstream advisory: http://www.squid-cache.org/Advisories/SQUID-2016_1.txt CVE request: http://seclists.org/oss-sec/2016/q1/345
Created squid tracking bugs for this issue: Affects: fedora-all [bug 1308866]
CVE assignment: http://seclists.org/oss-sec/2016/q1/348
Fix committed to F24 and RAWHIDE.
Statement: This issue did not affect the versions of squid as shipped with Red Hat Enterprise Linux versions 5, 6 and 7, as they are not shipped with a vulnerable version of squid, and no currently backported patch would introduce the bug.