A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libecap-develUpgrade libecapUpgrade squid | Oct 11, 2022 | Oct 6, 2022 |
| Alpine Linux | — | Upgrade squid | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade squid-sysvinitUpgrade squid-debuginfoUpgrade squid-migration-scriptUpgrade squid | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade squid | Feb 7, 2023 | Sep 26, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade squid-migration-scriptUpgrade squid-debuginfoUpgrade libecap-debugsourceUpgrade libecap-develUpgrade libecap-debuginfoUpgrade squid-sysvinitUpgrade squidUpgrade squid-debugsourceUpgrade libecap | Oct 20, 2022 | Oct 4, 2022 |
| Debian | — | Upgrade squid | Oct 14, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade squid | Mar 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade squid | Dec 9, 2022 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade libecapUpgrade libecap-develUpgrade squidUpgrade squid-migration-scriptUpgrade squid-sysvinit | Oct 5, 2022 | Sep 23, 2022 |
| Redhat_linux | — | Upgrade libecap-develUpgrade squid-migration-scriptUpgrade squidNo solution existsUpgrade squid-sysvinitUpgrade libecap-debugsourceUpgrade squid-debugsourceUpgrade squid-debuginfoUpgrade libecapUpgrade libecap-debuginfo | Oct 20, 2022 | Oct 4, 2022 |
| Rocky_linux | — | Upgrade squid-debugsourceUpgrade squid-debuginfoUpgrade libecap-debuginfoUpgrade libecap-debugsourceUpgrade squidUpgrade libecap-develUpgrade libecap | Mar 12, 2024 | Dec 25, 2022 |
| Suse | — | Upgrade squid | Oct 26, 2022 | Oct 6, 2022 |
| Ubuntu | — | Upgrade squid3 (Ubuntu Pro)Upgrade squid (Ubuntu Pro)Upgrade squid | Sep 27, 2022 | Sep 26, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub