CVE-2018-1000024

NameCVE-2018-1000024
DescriptionThe Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1266-1, DSA-4122-1
NVD severitymedium (attack range: remote)
Debian Bugs888719

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)buster, sid4.3-1fixed
squid3 (PTS)jessie (security), jessie3.4.8-6+deb8u5fixed
stretch (security), stretch3.5.23-5+deb9u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsource(unstable)4.1-1medium
squidsourceexperimental4.0.23-1~exp8medium
squidsourcewheezy(not affected)
squid3source(unstable)3.5.27-1medium888719
squid3sourcejessie3.4.8-6+deb8u5mediumDSA-4122-1
squid3sourcestretch3.5.23-5+deb9u1mediumDSA-4122-1
squid3sourcewheezy3.1.20-2.2+deb7u8mediumDLA-1266-1

Notes

[wheezy] - squid <not-affected> (Not affected according to upstream advisory)
src:squid as source package reintroduced for 4.x in experimental
Squid 3.5: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_1.patch
Squid 4: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_1.patch
http://www.squid-cache.org/Advisories/SQUID-2018_1.txt
Squid3 in Debian builds to use the libxml2 or libexpat XML parsers.

Search for package or bug name: Reporting problems