A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade squidUpgrade libecapUpgrade libecap-devel | Oct 11, 2022 | Oct 6, 2022 |
| Alpine Linux | — | Upgrade squid | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade squidUpgrade squid-sysvinitUpgrade squid-debuginfoUpgrade squid-migration-script | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade squid | Feb 7, 2023 | Sep 26, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade libecap-debuginfoUpgrade libecap-develUpgrade squid-migration-scriptUpgrade squid-sysvinitUpgrade squidUpgrade squid-debuginfoUpgrade libecap-debugsourceUpgrade libecapUpgrade squid-debugsource | Oct 20, 2022 | Oct 4, 2022 |
| Debian | — | Upgrade squid | Oct 14, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade squid | Mar 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade squid | Dec 9, 2022 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade squid-sysvinitUpgrade squid-migration-scriptUpgrade libecap-develUpgrade libecapUpgrade squid | Oct 5, 2022 | Sep 23, 2022 |
| Redhat_linux | — | Upgrade libecap-develUpgrade squidUpgrade squid-migration-scriptUpgrade squid-debuginfoUpgrade libecapUpgrade libecap-debuginfoNo solution existsUpgrade squid-sysvinitUpgrade squid-debugsourceUpgrade libecap-debugsource | Oct 20, 2022 | Oct 4, 2022 |
| Rocky_linux | — | Upgrade libecapUpgrade libecap-develUpgrade squidUpgrade squid-debuginfoUpgrade libecap-debugsourceUpgrade squid-debugsourceUpgrade libecap-debuginfo | Mar 12, 2024 | Dec 25, 2022 |
| Suse | — | Upgrade squid | Oct 26, 2022 | Oct 6, 2022 |
| Ubuntu | — | Upgrade squid (Ubuntu Pro)Upgrade squidUpgrade squid3 (Ubuntu Pro) | Sep 27, 2022 | Sep 26, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub