Input validation error in Squid - CVE-2021-31806

Vulnerability identifier: #VU53020

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31806

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote client to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when performing HTTP Range requests. A remote proxy client can send specially crafted HTTP request via the proxy server  and perform a denial of service (DoS) attack.

Squid
Amazon Linux AMI
Gentoo Linux
SUSE Manager Server
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Server Applications
Ubuntu
openEuler
Fedora
squid (Debian package)
libecap-devel
libecap
squid
squid (Ubuntu package)
squid-debugsource
squid-debuginfo

Install updates from vendor's website.

Squid - addressed in versions 4.15, 5.0.6
squid (Debian package) - update to 4.6-1+deb10u6
libecap-devel - update to 1.0.1-2.0.1
libecap - update to 1.0.1-2.0.1
squid - update to 3.5.20-17.44
squid (Ubuntu package) - addressed in versions 3.5.27-1ubuntu1.11, 4.10-1ubuntu1.4, 4.13-1ubuntu2.2, 4.13-1ubuntu4.1
squid-debugsource - update to 4.9-8
squid-debuginfo - update to 4.9-8
squid - update to 4.9-8
squid - addressed in versions 4.15-1.fc33, 5.0.6-1.fc34
squid - update to 4.15-3
squid-debugsource - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid-debuginfo - addressed in versions 4.15-4.18.1, 4.15-5.26.1
squid - addressed in versions 4.15-4.18.1, 4.15-5.26.1

• Exploit #6912 - Squid Proxy Range Header DoS (October 21, 2021)

• https://github.com/squid-cache/squid/security/advisories/GHSA-pxwq-f3qr-w2xf/

• Multiple vulnerabilities in Squid
• Gentoo update for Squid
• Debian update for squid
• SUSE update for squid
• SUSE update for squid
• Amazon Linux AMI update for squid
• Ubuntu update for squid
• openEuler 20.03 LTS SP1 update for squid
• Red Hat Enterprise Linux 8 update for the squid:4 module
• Fedora 33 update for squid
• Fedora 34 update for squid
• Anolis OS update for squid:4 module