CVE-2020-24606

NameCVE-2020-24606
DescriptionSquid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4751-1
NVD severityhigh
Debian Bugs968933

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)buster, buster (security)4.6-1+deb10u4fixed
bullseye, sid4.13-1fixed
squid3 (PTS)stretch3.5.23-5+deb9u1vulnerable
stretch (security)3.5.23-5+deb9u4vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsourcebuster4.6-1+deb10u4DSA-4751-1
squidsource(unstable)4.13-1968933
squid3source(unstable)(unfixed)

Notes

https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg
Squid 4: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patch

Search for package or bug name: Reporting problems