CVE-2021-28116

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.(CVE-2021-28116)

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

• squid: out-of-bounds read in WCCP protocol data may lead to information disclosure (CVE-2021-28116)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es):

• squid: out-of-bounds read in WCCP protocol data may lead to information disclosure (CVE-2021-28116) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2021-28116: Fix out of bound access when processing WCCPv2 messages

• CVE-2021-28116: Fix out of bound access when processing WCCPv2 messages

• CVE-2021-28116: fix out-of-bounds read in WCCPv2 message parsing via stricter bounds validation of security, service, router, view, and capability items

• CVE-2021-28116: fix out-of-bounds read in WCCPv2 message parsing via stricter bounds validation of security, service, router, view, and capability items

• CVE-2021-28116: fix out-of-bounds read in WCCPv2 message parsing via stricter bounds validation of security, service, router, view, and capability items

Updated squid packages fix security vulnerability:

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody (CVE-2021-28116).

Squid is updated to 4.17 that fixes this issue and other bugs.

This update for squid fixes the following issues:

Update to version 4.17:

• CVE-2021-28116: Fixed a out-of-bounds read in the WCCP protocol (bsc#1189403).

This update was imported from the SUSE:SLE-15:Update update project.

This update for squid fixes the following issues:

Update to version 4.17:

• CVE-2021-28116: Fixed a out-of-bounds read in the WCCP protocol (bsc#1189403).

These are all security issues fixed in the squid-5.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for squid fixes the following issues:

Update to version 4.17:

• CVE-2021-28116: Fixed a out-of-bounds read in the WCCP protocol (bsc#1189403).

This update for squid fixes the following issues:

Update to version 4.17:

• CVE-2021-28116: Fixed a out-of-bounds read in the WCCP protocol (bsc#1189403).

Lyu discovered that Squid incorrectly handled WCCP protocol data. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly obtain sensitive information.