CVE-2016-2390

Name	CVE-2016-2390
Description	The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
squid (PTS)	buster, sid	4.4-1	vulnerable
squid3 (PTS)	jessie	3.4.8-6+deb8u5	vulnerable
	jessie (security)	3.4.8-6+deb8u6	vulnerable
	stretch (security), stretch	3.5.23-5+deb9u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
squid	source	(unstable)	(unfixed)	unimportant
squid3	source	(unstable)	3.5.14-1	unimportant

http://www.squid-cache.org/Advisories/SQUID-2016_1.txt
Only affects custom builds with --enable-ssl (disabled for license purposes in Debian)