Red Hat Security Advisory

RHSA-2024:11049

squid security update

Released 2024-12-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server (v. 7 ELS) squid-7:3.5.20-17.el7_9.13, squid-migration-script-7:3.5.20-17.el7_9.13
Red Hat Enterprise Linux Server Optional (v. 7 ELS) squid-sysvinit-7:3.5.20-17.el7_9.13

Fixes 1 record

TI-2023-25305 CVE-2023-46846

Squid: request/response smuggling in http/1.1 and icap

MEDIUM 56

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.07158 Published 2023-11-03 Partial fix · 6.4, 7:3.5.20-17.el7_9.13 +9 CWE-444