{"id":"CVE-2022-41317","aliases":["ALPINE-CVE-2022-41317","CLSA-2026-1777054556","CLSA-2026-1778252773","DEBIAN-CVE-2022-41317","DLA-3151-1","DSA-5258-1","EUVD-2022-44525","GHSA-rcg9-7fqm-83mq","MGASA-2022-0351","OESA-2022-1974","SUSE-SU-2022:3531-1","SUSE-SU-2022:3532-1","SUSE-SU-2022:3533-1","SUSE-SU-2022:3596-1","UBUNTU-CVE-2022-41317","USN-5641-1","openSUSE-SU-2024:12364-1"],"status":"published","title":"squid: Fix of 2 CVEs","description":"An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01849,"percentile":0.79258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-697"],"published":"2022-09-23T00:00:00Z","modified":"2026-11-03T07:18:33Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"squid","fixed_in":["5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"squid","fixed_in":["5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"squid","fixed_in":["5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"squid","fixed_in":["5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"squid","fixed_in":["5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"squid","fixed_in":["5.7-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"squid","fixed_in":["7:5.5-5.el9_2.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"squid","fixed_in":["5.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squid","fixed_in":["5.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squid","fixed_in":["5.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"squid","fixed_in":["4.10-1ubuntu1.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"squid","fixed_in":["5.2-1ubuntu4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9"},{"fixed":"5.7-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-19.el9_6.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-5.el9_2.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u8"}]}],"versions":["4.6-1","4.6-1+deb10u1","4.6-1+deb10u2","4.6-1+deb10u3","4.6-1+deb10u4","4.6-1+deb10u5","4.6-1+deb10u6","4.6-1+deb10u7"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-10+deb11u2"}]}],"versions":["4.13-10","4.13-10+deb11u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-1.2.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-13.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-13.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-16.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-4.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-4.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.7"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3","4.10-1ubuntu1.4","4.10-1ubuntu1.5","4.10-1ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-1ubuntu4.2"}]}],"versions":["4.13-10ubuntu5","5.2-1ubuntu1","5.2-1ubuntu3","5.2-1ubuntu4","5.2-1ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9","3.5.27-1ubuntu1.10","3.5.27-1ubuntu1.11","3.5.27-1ubuntu1.12","3.5.27-1ubuntu1.13"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.7"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3","4.10-1ubuntu1.4","4.10-1ubuntu1.5","4.10-1ubuntu1.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-1ubuntu4.2"}]}],"versions":["4.13-10ubuntu5","5.2-1ubuntu1","5.2-1ubuntu3","5.2-1ubuntu4","5.2-1ubuntu4.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-2.1"}]}],"bundled":2}],"products":[{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq","tags":["x_transferred","Mitigation","Patch","Third Party Advisory","advisory"]},{"url":"http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch","tags":["x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patch","tags":["x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://www.openwall.com/lists/oss-security/2022/09/23/1","tags":["x_transferred","Mailing List","Mitigation","Patch","Third Party Advisory","web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-41317","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777054556.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778252773.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41317.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41317","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-41317","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0351.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30883","tags":["report"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5641-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41318","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223531-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203677","tags":["report"]},{"url":"https://bugzilla.suse.com/1203680","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41318","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223532-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223533-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223596-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-41317","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41318","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-41317","description":"An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-14T18:34:22.37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2022-44525","description":"An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-14T18:34:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:32.642133Z"}],"nvd":[{"id":"CVE-2022-41317","description":"An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.","status":"published","published":"2022-12-25T19:15:10.767Z","modified":"2026-06-17T05:03:00.777Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"ALPINE-CVE-2022-41317","description":"An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.","status":"published","published":"2022-12-25T19:15:10.767Z","modified":"2026-11-03T07:18:33.700728917Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-41317","description":"An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.","status":"published","published":"2022-12-25T00:00:00Z","modified":"2026-10-28T10:31:24.355337343Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"OESA-2022-1974","title":"squid security update","description":"Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.\r\n\r\nSecurity Fix(es):\r\n\r\nExposure of Sensitive Information in Cache Manager \nhttps://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq(CVE-2022-41317)\r\n\r\nBuffer Over Read in SSPI and SMB Authentication \nhttps://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78(CVE-2022-41318)","status":"published","published":"2022-09-30T11:05:17Z","modified":"2026-08-18T01:17:19.035008925Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-41317","description":"An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.","status":"published","published":"2022-09-23T00:00:00Z","modified":"2026-02-04T03:08:24.909909Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"CLSA-2026-1777054556","title":"squid: Fix of 2 CVEs","description":"- CVE-2022-41317: fix exposure of sensitive cache manager information via\n  non-HTTP URI schemes due to typo in default manager ACL regex\n- CVE-2023-49288: fix use-after-free in StoreEntry::startWriting() reachable\n  via oversized replies with collapsed_forwarding enabled","status":"published","published":"2026-04-24T18:16:01Z","modified":"2026-06-01T00:32:48.69879427Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778252773","title":"squid: Fix of CVE-2022-41317","description":"- CVE-2022-41317: fix exposure of sensitive cache manager information via\n  non-HTTP URI schemes due to typo in default manager ACL regex","status":"published","published":"2026-05-08T21:01:56Z","modified":"2026-06-01T00:32:29.843046818Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DEBIAN-CVE-2022-41317","description":"An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.","status":"published","published":"2022-12-25T19:15:10.767Z","modified":"2026-11-03T06:03:11.230700969Z","updated_at":"2026-11-03T06:42:33.899035Z"},{"id":"DLA-3151-1","title":"squid - security update","status":"published","published":"2022-10-13T00:00:00Z","modified":"2026-03-09T01:21:50.156379Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5258-1","title":"squid - security update","status":"published","published":"2022-10-19T00:00:00Z","modified":"2026-03-09T02:09:12.471915Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0351","title":"Updated squid packages fix security vulnerability","description":"Exposure of Sensitive Information in Cache Manager. (CVE-2022-41317)\nBuffer Over Read in SSPI and SMB Authentication. (CVE-2022-41318)\n","status":"published","published":"2022-10-01T17:48:24Z","modified":"2026-04-16T04:40:42.773969967Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12364-1","title":"squid-5.7-2.1 on GA media","description":"These are all security issues fixed in the squid-5.7-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:43:57.193812Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:3531-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n  Updated squid to version 5.7:\n  - CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).\n  - CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).\n","status":"published","published":"2022-10-06T07:21:55Z","modified":"2026-02-04T03:35:12.337885Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3532-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n  - CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).\n  - CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).\n","status":"published","published":"2022-10-06T07:22:03Z","modified":"2026-02-04T02:34:20.036905Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3533-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n  - CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).\n  - CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).\n","status":"published","published":"2022-10-06T07:22:33Z","modified":"2025-05-02T04:33:37.62043Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3596-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n  - CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).\n  - CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).\n","status":"published","published":"2022-10-17T11:10:12Z","modified":"2026-02-04T03:29:09.437007Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5641-1","title":"squid, squid3 vulnerabilities","description":"Mikhail Evdokimov discovered that Squid incorrectly handled cache manager\nACLs. A remote attacker could possibly use this issue to obtain sensitive\ninformation. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04\nLTS. (CVE-2022-41317)\n\nIt was discovered that Squid incorrectly handled SSPI and SMB\nauthentication. A remote attacker could use this issue to cause Squid to\ncrash, resulting in a denial of service, or possibly obtain sensitive\ninformation. (CVE-2022-41318)\n","status":"published","published":"2022-09-26T16:23:50Z","modified":"2026-02-10T04:42:47Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}