Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
NA

CVE-2023-46846

Published: 03/11/2023 Updated: 22/01/2024
CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9
VMScore: 0
Subscribe to Squid

Vulnerability Summary

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote malicious user to perform Request/Response smuggling past firewall and frontend security systems.

Vulnerable Product Search on Vulmon Subscribe to Product

squid-cache squid

redhat enterprise linux 8.0

redhat enterprise linux server tus 8.2

redhat enterprise linux server aus 8.2

redhat enterprise linux server tus 8.4

redhat enterprise linux server aus 8.4

redhat enterprise linux server aus 8.6

redhat enterprise linux server tus 8.6

redhat enterprise linux eus 8.6

redhat enterprise linux 9.0

redhat enterprise linux eus 9.0

redhat enterprise linux server tus 8.8

redhat enterprise linux eus 8.8

redhat enterprise linux server aus 9.2

redhat enterprise linux eus 9.2

redhat enterprise linux for power little endian 8.0_ppc64le

redhat enterprise linux for ibm z systems 8.0_s390x

redhat enterprise linux for arm 64 8.0_aarch64

redhat enterprise linux server tus 9.2

Vendor Advisories

Red Hat: Critical: squid:4 security update
Synopsis Critical: squid:4 security update Type/Severity Security Advisory: Critical Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the squid:4 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ...
Red Hat: Critical: squid:4 security update
Synopsis Critical: squid:4 security update Type/Severity Security Advisory: Critical Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the squid:4 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ...
Red Hat: Critical: squid security update
Synopsis Critical: squid security update Type/Severity Security Advisory: Critical Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for squid is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security has rated this ...
Red Hat: Critical: squid security update
Synopsis Critical: squid security update Type / Sévérité Security Advisory: Critical Analyse des correctifs dans Red Hat Insights Identifiez et remédiez aux systèmes concernés par cette alerte Voir les systèmes concernés Sujet An update for squid is now available for Red Hat Enterprise Linux 9Red Hat Product Security has r ...
Red Hat: Critical: squid security update
Synopsis Critical: squid security update Type/Severity Security Advisory: Critical Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for squid is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having a securi ...
Amazon Linux 2: ALAS-2024-2509
A flaw was found in squid When Squid is parsing ESI, it keeps the ESI elements in ESIContext ESIContext contains a buffer for holding a stack of ESIElements When a new ESIElement is parsed, it is added via addStackElement addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 el ...

References

CWE-444https://access.redhat.com/errata/RHSA-2023:6266https://access.redhat.com/errata/RHSA-2023:6267https://access.redhat.com/errata/RHSA-2023:6268https://access.redhat.com/security/cve/CVE-2023-46846https://bugzilla.redhat.com/show_bug.cgi?id=2245910https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqhhttps://access.redhat.com/errata/RHSA-2023:6748https://access.redhat.com/errata/RHSA-2023:6801https://access.redhat.com/errata/RHSA-2023:6803https://access.redhat.com/errata/RHSA-2023:6804https://access.redhat.com/errata/RHSA-2023:6810https://access.redhat.com/errata/RHSA-2023:7213https://security.netapp.com/advisory/ntap-20231130-0002/https://lists.debian.org/debian-lts-announce/2024/01/msg00003.htmlhttps://lists.debian.org/debian-lts-announce/2024/01/msg00008.htmlhttps://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2023:6267https://alas.aws.amazon.com/AL2/ALAS-2024-2509.html
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook