Memory leak in Squid - CVE-2021-28652
Published: May 10, 2021
Vulnerability identifier: #VU53019
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-28652
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote client to perform DoS attack on the target system.
The vulnerability exists due memory leak due to incorrect parser validation in Cache Manager API. A remote trusted client with Cache Manager API access privilege can perform denial of service attack.
Affected software
Squid
Gentoo Linux
Amazon Linux AMI
Arch Linux
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Server Applications
Ubuntu
openEuler
Fedora
squid (Debian package)
libecap-devel
libecap
squid
squid (Ubuntu package)
squid-debugsource
squid-debuginfo
Gentoo Linux
Amazon Linux AMI
Arch Linux
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Server Applications
Ubuntu
openEuler
Fedora
squid (Debian package)
libecap-devel
libecap
squid
squid (Ubuntu package)
squid-debugsource
squid-debuginfo
How to mitigate CVE-2021-28652
Install updates from vendor's website.
Squid - addressed in versions 4.15, 5.0.6
squid (Debian package) - update to 4.6-1+deb10u6
libecap-devel - update to 1.0.1-2.0.1
libecap - update to 1.0.1-2.0.1
squid - update to 3.5.20-17.44
squid (Ubuntu package) - addressed in versions 3.5.27-1ubuntu1.11, 4.10-1ubuntu1.4, 4.13-1ubuntu2.2, 4.13-1ubuntu4.1
squid-debugsource - update to 4.9-8
squid-debuginfo - update to 4.9-8
squid - update to 4.9-8
squid - addressed in versions 4.15-1.fc33, 5.0.6-1.fc34
squid - update to 4.15-3
squid-debugsource - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid-debuginfo - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid (Debian package) - update to 4.6-1+deb10u6
libecap-devel - update to 1.0.1-2.0.1
libecap - update to 1.0.1-2.0.1
squid - update to 3.5.20-17.44
squid (Ubuntu package) - addressed in versions 3.5.27-1ubuntu1.11, 4.10-1ubuntu1.4, 4.13-1ubuntu2.2, 4.13-1ubuntu4.1
squid-debugsource - update to 4.9-8
squid-debuginfo - update to 4.9-8
squid - update to 4.9-8
squid - addressed in versions 4.15-1.fc33, 5.0.6-1.fc34
squid - update to 4.15-3
squid-debugsource - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid-debuginfo - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid - addressed in versions 4.15-4.18.1, 4.15-5.26.1
External References
Related Security Bulletins
- Multiple vulnerabilities in Squid
- Arch Linux update for squid
- Gentoo update for Squid
- Debian update for squid
- SUSE update for squid
- SUSE update for squid
- Amazon Linux AMI update for squid
- Ubuntu update for squid
- openEuler 20.03 LTS SP1 update for squid
- Red Hat Enterprise Linux 8 update for the squid:4 module
- Fedora 33 update for squid
- Fedora 34 update for squid
- Anolis OS update for squid:4 module