SB2024111433 - Red Hat Enterprise Linux 8 update for the squid:4 module

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024111433

SB2024111433 - Red Hat Enterprise Linux 8 update for the squid:4 module

Published: November 14, 2024

Security Bulletin ID SB2024111433
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Expired pointer dereference (CVE-ID: CVE-2024-23638)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an expired pointer dereference in the Cache Manager when handling error responses. A remote attacker can perform a denial of service (DoS) attack.


2) Resource management error (CVE-ID: CVE-2024-45802)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing ESI response content. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability requires that Squid is acting as reverse proxy where ESI feature has been enabled at build time.


Remediation

Install update from vendor's website.

References