CVE-2018-1000024

NameCVE-2018-1000024
DescriptionThe Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1266-1
Debian Bugs888719

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)wheezy2.7.STABLE9-4.1+deb7u1fixed
wheezy (security)2.7.STABLE9-4.1+deb7u3fixed
squid3 (PTS)wheezy3.1.20-2.2+deb7u4vulnerable
wheezy (security)3.1.20-2.2+deb7u8fixed
jessie (security), jessie3.4.8-6+deb8u4vulnerable
stretch3.5.23-5vulnerable
buster, sid3.5.27-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsource(unstable)(unfixed)
squidsourceexperimental4.0.23-1~exp8
squidsourcewheezy(not affected)
squid3source(unstable)3.5.27-1888719
squid3sourcewheezy3.1.20-2.2+deb7u8DLA-1266-1

Notes

[wheezy] - squid <not-affected> (Not affected according to upstream advisory)
src:squid as source package reintroduced for 4.x in experimental
Squid 3.5: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_1.patch
Squid 4: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_1.patch
http://www.squid-cache.org/Advisories/SQUID-2018_1.txt
Squid3 in Debian builds to use the libxml2 or libexpat XML parsers.

Search for package or bug name: Reporting problems