A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libecap-develUpgrade squidUpgrade libecap | Oct 11, 2022 | Oct 6, 2022 |
| Alpine Linux | — | Upgrade squid | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade squid-debuginfoUpgrade squid-sysvinitUpgrade squid-migration-scriptUpgrade squid | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade squid | Feb 7, 2023 | Sep 26, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade libecap-debuginfoUpgrade squid-debuginfoUpgrade libecap-develUpgrade squid-migration-scriptUpgrade libecap-debugsourceUpgrade squid-sysvinitUpgrade squidUpgrade libecapUpgrade squid-debugsource | Oct 20, 2022 | Oct 4, 2022 |
| Debian | — | Upgrade squid | Oct 14, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade squid | Mar 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade squid | Dec 9, 2022 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade squidUpgrade libecap-develUpgrade libecapUpgrade squid-migration-scriptUpgrade squid-sysvinit | Oct 5, 2022 | Sep 23, 2022 |
| Redhat_linux | — | Upgrade libecap-debugsourceUpgrade squid-debugsourceUpgrade squid-sysvinitUpgrade libecapUpgrade squid-debuginfoUpgrade libecap-debuginfoNo solution existsUpgrade squidUpgrade squid-migration-scriptUpgrade libecap-devel | Oct 20, 2022 | Oct 4, 2022 |
| Rocky_linux | — | Upgrade libecap-debuginfoUpgrade squid-debugsourceUpgrade squid-debuginfoUpgrade libecap-debugsourceUpgrade libecapUpgrade libecap-develUpgrade squid | Mar 12, 2024 | Dec 25, 2022 |
| Suse | — | Upgrade squid | Oct 26, 2022 | Oct 6, 2022 |
| Ubuntu | — | Upgrade squid3 (Ubuntu Pro)Upgrade squid (Ubuntu Pro)Upgrade squid | Sep 27, 2022 | Sep 26, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub