Memory leak in Squid - CVE-2021-28652

 

Memory leak in Squid - CVE-2021-28652

Published: May 10, 2021


Vulnerability identifier: #VU53019
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-28652
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote client to perform DoS attack on the target system.

The vulnerability exists due memory leak due to incorrect parser validation in Cache Manager API. A remote trusted client with Cache Manager API access privilege can perform denial of service attack.


Affected software

Squid
Gentoo Linux
Amazon Linux AMI
Arch Linux
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Server Applications
Ubuntu
openEuler
Fedora
squid (Debian package)
libecap-devel
libecap
squid
squid (Ubuntu package)
squid-debugsource
squid-debuginfo

How to mitigate CVE-2021-28652

Install updates from vendor's website.

Squid - addressed in versions 4.15, 5.0.6
squid (Debian package) - update to 4.6-1+deb10u6
libecap-devel - update to 1.0.1-2.0.1
libecap - update to 1.0.1-2.0.1
squid - update to 3.5.20-17.44
squid (Ubuntu package) - addressed in versions 3.5.27-1ubuntu1.11, 4.10-1ubuntu1.4, 4.13-1ubuntu2.2, 4.13-1ubuntu4.1
squid-debugsource - update to 4.9-8
squid-debuginfo - update to 4.9-8
squid - update to 4.9-8
squid - addressed in versions 4.15-1.fc33, 5.0.6-1.fc34
squid - update to 4.15-3
squid-debugsource - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid-debuginfo - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid - addressed in versions 4.15-4.18.1, 4.15-5.26.1

External References

Related Security Bulletins