SB20250328386 - Anolis OS update for squid:4 module

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20250328386

SB20250328386 - Anolis OS update for squid:4 module

Published: March 28, 2025

Security Bulletin ID SB20250328386
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Expired pointer dereference (CVE-ID: CVE-2024-23638)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an expired pointer dereference in the Cache Manager when handling error responses. A remote attacker can perform a denial of service (DoS) attack.


2) Resource management error (CVE-ID: CVE-2024-45802)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing ESI response content. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability requires that Squid is acting as reverse proxy where ESI feature has been enabled at build time.


Remediation

Install update from vendor's website.

References