CVE-2023-49288

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

• squid: DoS against HTTP and HTTPS (CVE-2023-5824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Denial of Service attack against HTTP header parsing
  • debian/patches/CVE-2023-49288.patch: fix unintention freeing in TRACE request handler
  • CVE-2023-49288

• SECURITY UPDATE: Denial of Service attack against HTTP header parsing
  • debian/patches/CVE-2023-49288.patch: fix unintentional freeing in TRACE request handler
  • CVE-2023-49288

• CVE-2023-49288: fix Denial of Service in HTTP Collapsed Forwarding

• SECURITY UPDATE: excessive cached HTTP response header size causing worker process stall or crash
  • debian/patches/CVE-2023-5824.patch: Refactor serialized HTTP response header handling to prevent cache flow
  • CVE-2023-5824
• SECURITY UPDATE: Use-After-Free in the HTTP Collapsed Forwarding Feature
  • debian/patches/CVE-2023-5824.patch: Removed Use-After-Free during refactor serialized HTTP response header
  • CVE-2023-49288

• CVE-2022-41317: fix exposure of sensitive cache manager information via non-HTTP URI schemes due to typo in default manager ACL regex
• CVE-2023-49288: fix use-after-free in StoreEntry::startWriting() reachable via oversized replies with collapsed_forwarding enabled

• CVE-2023-49288: fix use-after-free in store_client lifetime by locking StoreEntry for the duration of the store_client object

• CVE-2023-49288: fix use-after-free in store_client lifetime by locking StoreEntry for the duration of the store_client object

• CVE-2023-49288: fix use-after-free in store_client lifetime by locking StoreEntry for the duration of the store_client object

Affected versions of squid are subject to a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. (CVE-2023-49288) Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug. (CVE-2023-5824)

These are all security issues fixed in the squid-6.6-2.1 package on the GA media of openSUSE Tumbleweed.

This update for squid fixes the following issues:

• CVE-2023-5824: Multiple issues in HTTP response caching (bsc#1216496).
• CVE-2023-49288: Use-After-Free in the HTTP Collapsed Forwarding Feature (bsc#1217825).
• CVE-2025-62168: failure to redact HTTP authentication credentials in error handling leads to the disclosure of credentials a trusted client uses to authenticate (bsc#1252281).
• CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
• CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
• CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
• CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
• CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

Joshua Rogers discovered that Squid incorrectly handled collapsed forwarding. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)

Joshua Rogers discovered that Squid incorrectly handled certain structural elements. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-5824)

Joshua Rogers discovered that Squid incorrectly handled Cache Manager error responses. A remote trusted client can possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2024-23638)

Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked decoder. A remote attacker could possibly use this issue to cause Squid to stop responding, resulting in a denial of service. (CVE-2024-25111)

Joshua Rogers discovered that Squid incorrectly handled HTTP header parsing. A remote trusted client can possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2024-25617)

USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused Squid to crash in certain environments on Ubuntu 20.04 LTS and was disabled in USN-6728-2. The problematic fix for CVE-2023-5824 has now been corrected and reinstated in this update.

We apologize for the inconvenience.

Original advisory details:

Joshua Rogers discovered that Squid incorrectly handled collapsed forwarding. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)

Joshua Rogers discovered that Squid incorrectly handled certain structural elements. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-5824)

Joshua Rogers discovered that Squid incorrectly handled Cache Manager error responses. A remote trusted client can possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2024-23638)

Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked decoder. A remote attacker could possibly use this issue to cause Squid to stop responding, resulting in a denial of service. (CVE-2024-25111)

Joshua Rogers discovered that Squid incorrectly handled HTTP header parsing. A remote trusted client can possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2024-25617)