Input validation error in Squid - CVE-2021-28662

Vulnerability identifier: #VU53018

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-28662

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing HTTP responses. A remote attacker who controls a malicious web page can send specially crafted HTTP response and perform a denial of service attack against the proxy server. The issue trigger is a header which can be expected to exist in HTTP traffic without any malicious intent by the server.

Squid
Gentoo Linux
Arch Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Server Applications
Ubuntu
openEuler
Fedora
squid (Debian package)
libecap-devel
libecap
squid (Ubuntu package)
squid-debugsource
squid-debuginfo
squid

Install updates from vendor's website.

Squid - addressed in versions 4.15, 5.0.6
squid (Debian package) - update to 4.6-1+deb10u6
libecap-devel - update to 1.0.1-2.0.1
libecap - update to 1.0.1-2.0.1
squid (Ubuntu package) - addressed in versions 3.5.27-1ubuntu1.11, 4.10-1ubuntu1.4, 4.13-1ubuntu2.2, 4.13-1ubuntu4.1
squid-debugsource - update to 4.9-8
squid-debuginfo - update to 4.9-8
squid - update to 4.9-8
squid - addressed in versions 4.15-1.fc33, 5.0.6-1.fc34
squid - update to 4.15-3
squid-debugsource - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid-debuginfo - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid - addressed in versions 4.15-4.18.1, 4.15-5.26.1

• https://github.com/squid-cache/squid/security/advisories/GHSA-jjq6-mh2h-g39h/

• Multiple vulnerabilities in Squid
• Arch Linux update for squid
• Gentoo update for Squid
• Debian update for squid
• SUSE update for squid
• SUSE update for squid
• Ubuntu update for squid
• openEuler 20.03 LTS SP1 update for squid
• Red Hat Enterprise Linux 8 update for the squid:4 module
• Fedora 33 update for squid
• Fedora 34 update for squid
• Anolis OS update for squid:4 module