CVE-2022-41317
squid: Fix of 2 CVEs
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- Record
CVE-2022-41317- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-697
- Updated
- 2026-11-02
CVE List
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- Record
CVE-2022-41317- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-697
- Updated
- 2026-11-02
EUVDEUVD-2022-44525
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- Record
EUVD-2022-44525- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVALPINE-CVE-2022-41317
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- Record
ALPINE-CVE-2022-41317- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- Record
CVE-2022-41317- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2022-1974
squid security update
Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.
Security Fix(es):
Exposure of Sensitive Information in Cache Manager https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq(CVE-2022-41317)
Buffer Over Read in SSPI and SMB Authentication https://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78(CVE-2022-41318)
- Record
OESA-2022-1974- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVUBUNTU-CVE-2022-41317
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- Record
UBUNTU-CVE-2022-41317- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1777054556 No score
squid: Fix of 2 CVEs
- CVE-2022-41317: fix exposure of sensitive cache manager information via non-HTTP URI schemes due to typo in default manager ACL regex
- CVE-2023-49288: fix use-after-free in StoreEntry::startWriting() reachable via oversized replies with collapsed_forwarding enabled
- Record
CLSA-2026-1777054556- Updated
- 2026-11-02
OSVCLSA-2026-1778252773 No score
squid: Fix of CVE-2022-41317
- CVE-2022-41317: fix exposure of sensitive cache manager information via non-HTTP URI schemes due to typo in default manager ACL regex
- Record
CLSA-2026-1778252773- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-41317 No score
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
- Record
DEBIAN-CVE-2022-41317- Updated
- 2026-11-03
OSVMGASA-2022-0351 No score
Updated squid packages fix security vulnerability
Exposure of Sensitive Information in Cache Manager. (CVE-2022-41317) Buffer Over Read in SSPI and SMB Authentication. (CVE-2022-41318)
- Record
MGASA-2022-0351- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12364-1 No score
squid-5.7-2.1 on GA media
These are all security issues fixed in the squid-5.7-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12364-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3531-1 No score
Security update for squid
This update for squid fixes the following issues:
Updated squid to version 5.7:
- CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).
- CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).
- Record
SUSE-SU-2022:3531-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3532-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).
- CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).
- Record
SUSE-SU-2022:3532-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3533-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).
- CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).
- Record
SUSE-SU-2022:3533-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3596-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).
- CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).
- Record
SUSE-SU-2022:3596-1- Updated
- 2026-11-02
OSVUSN-5641-1 No score
squid, squid3 vulnerabilities
Mikhail Evdokimov discovered that Squid incorrectly handled cache manager ACLs. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-41317)
It was discovered that Squid incorrectly handled SSPI and SMB authentication. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2022-41318)
- Record
USN-5641-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidAlpine:v3.19 |
4.9 up to 5.7-r0 | 5.7-r0 |
squidAlpine:v3.20 |
4.9 up to 5.7-r0 | 5.7-r0 |
squidAlpine:v3.21 |
4.9 up to 5.7-r0 | 5.7-r0 |
squidAlpine:v3.22 |
4.9 up to 5.7-r0 | 5.7-r0 |
squidAlpine:v3.23 |
4.9 up to 5.7-r0 | 5.7-r0 |
squidAlpine:v3.24 |
4.9 up to 5.7-r0 | 5.7-r0 |
squidTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 7:5.5-19.el9_6.1.tuxcare.els5 | 7:5.5-19.el9_6.1.tuxcare.els5 |
squidTuxCare:AlmaLinux:9.2 |
before 7:5.5-5.el9_2.1.tuxcare.els13 | 7:5.5-5.el9_2.1.tuxcare.els13 |
squidDebian:12 |
before 5.7-1 | 5.7-1 |
squidDebian:13 |
before 5.7-1 | 5.7-1 |
Show 44 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squidDebian:14 |
before 5.7-1 | 5.7-1 |
squidDebian:10 From an advisory covering 2 CVEs |
before 4.6-1+deb10u8, plus listed versions 4.6-14.6-1+deb10u14.6-1+deb10u24.6-1+deb10u34.6-1+deb10u44.6-1+deb10u54.6-1+deb10u64.6-1+deb10u7 |
4.6-1+deb10u8 |
squidDebian:11 From an advisory covering 2 CVEs |
before 4.13-10+deb11u2, plus listed versions 4.13-104.13-10+deb11u1 |
4.13-10+deb11u2 |
squidMageia:8 From an advisory covering 2 CVEs |
before 4.17-1.2.mga8 | 4.17-1.2.mga8 |
squidopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 4.9-13.oe1 | 4.9-13.oe1 |
squidopenEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 4.9-13.oe1 | 4.9-13.oe1 |
squidopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 4.9-16.oe2203 | 4.9-16.oe2203 |
squidSUSE:Linux Enterprise Module for Server Applications 15 SP4 From an advisory covering 2 CVEs |
before 5.7-150400.3.6.1 | 5.7-150400.3.6.1 |
squidopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 5.7-150400.3.6.1 | 5.7-150400.3.6.1 |
squidSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 4.17-4.27.1 | 4.17-4.27.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 4.17-4.27.1 | 4.17-4.27.1 |
squidSUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs |
before 3.5.21-26.38.1 | 3.5.21-26.38.1 |
squidSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs |
before 3.5.21-26.38.1 | 3.5.21-26.38.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 3.5.21-26.38.1 | 3.5.21-26.38.1 |
squidSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 2 CVEs |
before 3.5.21-26.38.1 | 3.5.21-26.38.1 |
squidSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 2 CVEs |
before 3.5.21-26.38.1 | 3.5.21-26.38.1 |
squidSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 2 CVEs |
before 3.5.21-26.38.1 | 3.5.21-26.38.1 |
squidSUSE:Linux Enterprise Module for Server Applications 15 SP3 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Manager Proxy 4.1 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Manager Retail Branch Server 4.1 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Manager Server 4.1 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Enterprise Storage 6 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidSUSE:Enterprise Storage 7 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 4.17-150000.5.35.1 | 4.17-150000.5.35.1 |
squidUbuntu:20.04:LTS |
before 4.10-1ubuntu1.7, plus listed versions 4.8-1ubuntu24.8-1ubuntu34.9-2ubuntu14.9-2ubuntu24.9-2ubuntu3 Show 8 moreShow less4.9-2ubuntu44.10-1ubuntu14.10-1ubuntu1.14.10-1ubuntu1.24.10-1ubuntu1.34.10-1ubuntu1.44.10-1ubuntu1.54.10-1ubuntu1.6 |
4.10-1ubuntu1.7 |
squidUbuntu:22.04:LTS |
before 5.2-1ubuntu4.2, plus listed versions 4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.1 |
5.2-1ubuntu4.2 |
squid3Ubuntu:18.04:LTS From an advisory covering 2 CVEs |
before 3.5.27-1ubuntu1.14, plus listed versions 3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.13.5.27-1ubuntu1.2 Show 11 moreShow less3.5.27-1ubuntu1.33.5.27-1ubuntu1.43.5.27-1ubuntu1.53.5.27-1ubuntu1.63.5.27-1ubuntu1.73.5.27-1ubuntu1.83.5.27-1ubuntu1.93.5.27-1ubuntu1.103.5.27-1ubuntu1.113.5.27-1ubuntu1.123.5.27-1ubuntu1.13 |
3.5.27-1ubuntu1.14 |
squidUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 4.10-1ubuntu1.7, plus listed versions 4.8-1ubuntu24.8-1ubuntu34.9-2ubuntu14.9-2ubuntu24.9-2ubuntu3 Show 8 moreShow less4.9-2ubuntu44.10-1ubuntu14.10-1ubuntu1.14.10-1ubuntu1.24.10-1ubuntu1.34.10-1ubuntu1.44.10-1ubuntu1.54.10-1ubuntu1.6 |
4.10-1ubuntu1.7 |
squidUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 5.2-1ubuntu4.2, plus listed versions 4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.1 |
5.2-1ubuntu4.2 |
squidopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 5.7-2.1 | 5.7-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-41317 is a medium vulnerability (CVSS 6.5) in Squid-cache Squid, published September 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in squid 5.7-r0.
References
github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq
squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch
openwall.com/lists/oss-security/2022/09/23/1
security.alpinelinux.org/vuln/CVE-2022-41317
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777054556.html
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-41317
security-tracker.debian.org/tracker/CVE-2022-41317
advisories.mageia.org/MGASA-2022-0351.html
bugs.mageia.org/show_bug.cgi?id=30883
ubuntu.com/security/notices/USN-5641-1
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1974
suse.com/support/update/announcement/2022/suse-su-20223531-1
bugzilla.suse.com/1203677
cve.org/CVERecord?id=CVE-2022-41317