Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libecapUpgrade squidUpgrade libecap-devel | Jan 9, 2024 | Nov 1, 2023 |
| Alpine Linux | — | Upgrade squid | Mar 26, 2024 | Nov 1, 2023 |
| Amazon Linux Ami 2 | — | Upgrade squid-sysvinitUpgrade squid-debuginfoUpgrade squidUpgrade squid-migration-script | Dec 5, 2023 | Nov 1, 2023 |
| Amazon_linux | — | Upgrade squid | Dec 5, 2023 | Nov 1, 2023 |
| Amazon_linux_2023 | — | Upgrade squidUpgrade squid-debuginfoUpgrade squid-debugsource | Feb 17, 2025 | Nov 1, 2023 |
| Centos_linux | — | Upgrade squid-sysvinitUpgrade squid-migration-scriptUpgrade squidUpgrade squid-debuginfo | Jan 5, 2024 | Nov 1, 2023 |
| Debian | — | Upgrade squid | Mar 11, 2024 | Nov 1, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade squid | Mar 13, 2024 | Nov 1, 2023 |
| Oracle_linux | — | Upgrade squidUpgrade libecap-develUpgrade squid-migration-scriptUpgrade libecapUpgrade squid-sysvinit | Jan 4, 2024 | Nov 1, 2023 |
| Redhat_linux | — | Upgrade squid-sysvinitUpgrade libecap-debuginfoUpgrade squid-debugsourceUpgrade squid-debuginfoUpgrade squid-migration-scriptUpgrade libecap-debugsourceUpgrade libecapNo solution existsUpgrade squidUpgrade libecap-devel | Jan 5, 2024 | Nov 1, 2023 |
| Rocky_linux | — | Upgrade squid-debuginfoUpgrade libecapUpgrade libecap-develUpgrade libecap-debugsourceUpgrade libecap-debuginfoUpgrade squid-debugsourceUpgrade squid | Mar 5, 2024 | Nov 1, 2023 |
| Suse | — | Upgrade squid | Nov 7, 2023 | Nov 1, 2023 |
| Ubuntu | — | Upgrade squid | Nov 23, 2023 | Nov 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 1, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub