CVE-2021-41611

Name	CVE-2021-41611
Description	An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
squid (PTS)	buster	4.6-1+deb10u7	fixed
	buster (security)	4.6-1+deb10u8	fixed
	bullseye (security), bullseye	4.13-10+deb11u2	fixed
	bookworm, sid	5.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
squid	source	buster	(not affected)
squid	source	bullseye	(not affected)
squid	source	(unstable)	5.2-1

Notes

[bullseye] - squid <not-affected> (Vulnerable code introduced later)
[buster] - squid <not-affected> (Vulnerable code introduced later)
https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r
Fixed by: http://www.squid-cache.org/Versions/v5/changesets/squid-5-533b4359f16cf9ed15a6d709a57a4b06e4222cfe.patch