The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3531-1 advisory.

    Updated squid to version 5.7:
      - CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677).
      - CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the squid package has been released.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5641-1 advisory.

    Mikhail Evdokimov discovered that Squid incorrectly handled cache manager ACLs. A remote attacker could     possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, and     Ubuntu 22.04 LTS. (CVE-2022-41317)

    It was discovered that Squid incorrectly handled SSPI and SMB authentication. A remote attacker could use     this issue to cause Squid to crash, resulting in a denial of service, or possibly obtain sensitive     information. (CVE-2022-41318)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c8cad41c95 advisory.

    - version update to 5.7.
    - security fixes CVE-2022-41317

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1950 advisory.

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it     allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount     of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of     memory consumption. (CVE-2021-28651)

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it     allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger     memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This     attack is limited to clients with Cache Manager API access privilege. (CVE-2021-28652)

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is     vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request     processing. (CVE-2021-31806)

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a     remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue     trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.
    (CVE-2021-31807)

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is     vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP     Range request to trigger this. (CVE-2021-31808)

    Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting     availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to     exist in HTTP traffic without any malicious intent by the server. (CVE-2021-33620)

    A flaw was found in squid. A trusted client can directly access the cache manager information, bypassing     the manager ACL protection and resulting in information disclosure. (CVE-2022-41317)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
165756	SUSE SLES15 / openSUSE 15 Security Update : squid (SUSE-SU-2022:3531-1)	Nessus	SuSE Local Security Checks	2022/10/7	2026/6/26	high
203407	Photon OS 4.0: Squid PHSA-2023-4.0-0310	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
165459	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Squid vulnerabilities (USN-5641-1)	Nessus	Ubuntu Local Security Checks	2022/9/26	2025/9/3	high
169122	Fedora 36 : squid (2022-c8cad41c95)	Nessus	Fedora Local Security Checks	2022/12/22	2024/11/14	high
171805	Amazon Linux 2 : squid (ALAS-2023-1950)	Nessus	Amazon Linux Local Security Checks	2023/2/22	2024/12/11	medium

检测

插件搜索

high

high

high

high

medium