CVE-2020-8517
En bref
- Source
- NVD
- EPSS
- EPSS 6.85 % · centile 94 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Rechercher sur…
Description
An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.
Faiblesses (CWE)
Références
- http://www.squid-cache.org/Advisories/SQUID-2020_3.txt
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-6982f1187a26557e582172965e266f544ea562a5.patch
- https://usn.ubuntu.com/4289-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html
- https://security.gentoo.org/glsa/202003-34
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
- https://security.netapp.com/advisory/ntap-20210304-0002/
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2020-29383
- GCVE · GCVE-0-2020-8517
Avis du CERT-FR
- CERTFR-2020-AVI-070 — Multiples vulnérabilités dans Squid · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*< 4.10cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |