The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0020 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-46724:
    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages.

    CVE-2023-46728:
    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests.

    CVE-2023-49285:
    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    CVE-2023-49286:
    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of     Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process     management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known     workarounds for this vulnerability.

    CVE-2023-5824:
    Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling     of Structural Elements bug.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0001 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-46724:
     Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid     versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial     of Service attack against SSL Certificate validation. This problem allows a remote server to perform     Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL     Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed     in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in     Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package     vendor for availability information on updated packages.

    CVE-2023-46728:
    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests.

    CVE-2023-49285:
    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    CVE-2023-49286:
    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of     Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process     management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known     workarounds for this vulnerability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the squid package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-429 advisory.

    2023-12-06: CVE-2023-46728 was added to this advisory.

    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests. (CVE-2023-46728)

    Due to chunked decoder lenience Squid is vulnerable to Request/Response smuggling attacks when parsing     HTTP/1.1 and ICAP messages. (CVE-2023-46846)

    This problem allows a remote client to perform Denial of Service when sending ftp:// URLs in HTTP Request     messages or constructing ftp:// URLs from FTP Native input.

    This issue is triggered during access control security checks, meaning clients may not have been permitted     to use the proxy yet.

    FTP support is always enabled and cannot be disabled completely. (CVE-2023-46848)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-0071 advisory.

    - squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)
    - squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)
    - squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-7340:01 advisory.

    squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)         squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)         squid: Buffer over-read in the HTTP Message processing feature     (CVE-2023-49285)         squid: Incorrect Check of Function Return Value In Helper Process management     (CVE-2023-49286)     CVE(s):
    CVE-2023-46724     CVE-2023-46728     CVE-2023-49285     CVE-2023-49286

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5637 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5637-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     March 08, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : squid     CVE ID         : CVE-2023-46724 CVE-2023-46846 CVE-2023-46847 CVE-2023-49285                      CVE-2023-49286 CVE-2023-50269 CVE-2024-23638 CVE-2024-25617                      CVE-2023-46848 CVE-2024-25111     Debian Bug     : 1055252 1054537 1055250 1055251 1058721

    Several security vulnerabilities have been discovered in Squid, a full featured     web proxy cache. Due to programming errors in Squid's HTTP request parsing,     remote attackers may be able to execute a denial of service attack by sending     large X-Forwarded-For header or trigger a stack buffer overflow while     performing HTTP Digest authentication. Other issues facilitate request     smuggling past a firewall or a denial of service against Squid's Helper process     management.

    In regard to CVE-2023-46728: Please note that support for the Gopher protocol     has simply been removed in future Squid versions. There are no plans by the     upstream developers of Squid to fix this issue. We recommend to reject all     Gopher URL requests instead.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 4.13-10+deb11u3.

    For the stable distribution (bookworm), these problems have been fixed in     version 5.7-2+deb12u1.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmXrHBNfFIAAAAAALgAo     aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD     RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7     UeSFng/+JAY5jG6Z/fVFf2M9SsqFhQm8mGT1CgOx39dYirUkdpcFOyADqWopwv+q     tci90QFuhnreW1DmO1GYRlZro+37iRjiryRKxETpUB1AnpPWs6RnyAA+mrqssDqg     PxxFkqpJFtpMhZU3VkDDbTkkvK2T0Hwjdn8TND6qA+B56exwW2DEZlm5aqCPiWRf     pdzPZTOZJEV2fT4UPWduiIN1l94VsLktfZY5Ox0/HmrdkAWJJFXQhj3wZPcbFLbB     leQ7Nkq6mpuw98UxOSa7hsE0crPm6ctrf7AYMx+qojtWJFcbFE+mUqzcf0aFYp0L     EfTSVAOVEXvbFytlX/oSWYE5GrZtTrnwProiXFJT7WvDYN2Mbqxgp/jB3jZygmrZ     rknvF84haHX16ZMXRlBDOlx1E3XSCB+/xRynwbGQe8RPzSRlOKuiFqn+qr3qCtOd     5Ua2+ZJXDpEP4aUseFb94FwJRfs9onBS+EYPt2xwcxcBGUiMJ/lY9Fj9p5MjQ1bZ     nCXuRNo2ao6qumLSraK2qPle7AucbuOtiMDsMFi6rGu3H0RVlk7oWGFO4rMRAcvX     IBYU2bWBIyi7J4IvJd+07QfNgofPvcld9XN7/LDgizmMZpCorpPq39Ta24y7U3e5     Zv+ye/kOYKuD0ij7M7jkT2hgxq6kKdlSEZbZ/wrlkSILrcjgwqw=     =qmZY
    -----END PGP SIGNATURE-----



Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0046 advisory.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests. (CVE-2023-46728)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of     Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process     management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-49286)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0772 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18253)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0771 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18255)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1787 advisory.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests. (CVE-2023-46728)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of     Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process     management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-49286)

  - Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through     2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial     of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of     Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is     configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. (CVE-2023-50269)

  - Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse     of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header     parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending     oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the     request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version     6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in     cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time     prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5.
    There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2     (CVE-2024-25617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7404:01 advisory.

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)
      * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)
      * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)
      * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0039 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-46724:
    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages.

    CVE-2023-46846:
    SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.

    CVE-2023-46847:
    Squid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication.

    CVE-2023-46848:
    Squid is vulnerable to Denial of Service,  where a remote attacker can perform DoS by sending ftp:// URLs     in HTTP Request messages or constructing ftp:// URLs from FTP Native input.

    CVE-2023-46728:
    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests.

    CVE-2023-5824:
    Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling     of Structural Elements bug.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4380-1 advisory.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

  - SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.
    (CVE-2023-46846)

  - Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication. (CVE-2023-46847)

  - Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs     in HTTP Request messages or constructing ftp:// URLs from FTP Native input. (CVE-2023-46848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4384-1 advisory.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

  - SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.
    (CVE-2023-46846)

  - Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication. (CVE-2023-46847)

  - Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs     in HTTP Request messages or constructing ftp:// URLs from FTP Native input. (CVE-2023-46848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
236724	Alibaba Cloud Linux 3 : 0020: squid:4 (ALINUX3-SA-2024:0020)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
238995	TencentOS Server 3: squid:4 (TSSA-2024:0001)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	high
203630	Photon OS 4.0: Squid PHSA-2023-4.0-0517	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
204419	Photon OS 5.0: Squid PHSA-2023-5.0-0154	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
185721	Amazon Linux 2023 : squid (ALAS2023-2023-429)	Nessus	Amazon Linux Local Security Checks	2023/11/15	2024/12/11	medium
187863	Oracle Linux 9 : squid (ELSA-2024-0071)	Nessus	Oracle Linux Local Security Checks	2024/1/10	2025/9/9	high
251723	Linux Distros Unpatched Vulnerability : CVE-2023-46724	Nessus	Misc.	2025/8/19	2025/8/19	high
292972	MiracleLinux 9 : squid-5.5-6.el9_3.5 (AXSA:2024-7340:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
191759	Debian dsa-5637 : squid - security update	Nessus	Debian Local Security Checks	2024/3/8	2025/1/24	medium
187715	Rocky Linux 8 : squid:4 (RLSA-2024:0046)	Nessus	Rocky Linux Local Security Checks	2024/1/9	2024/1/9	high
190402	RHEL 8 : squid:4 (RHSA-2024:0772)	Nessus	Red Hat Local Security Checks	2024/2/12	2025/8/27	critical
190404	RHEL 8 : squid:4 (RHSA-2024:0771)	Nessus	Red Hat Local Security Checks	2024/2/12	2025/8/27	critical
208495	CentOS 7 : squid (RHSA-2024:1787)	Nessus	CentOS Local Security Checks	2024/10/9	2025/1/10	high
292878	MiracleLinux 8 : squid:4 (AXSA:2024-7404:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
239315	TencentOS Server 4: squid (TSSA-2024:0039)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
184793	SUSE SLES15 / openSUSE 15 Security Update : squid (SUSE-SU-2023:4380-1)	Nessus	SuSE Local Security Checks	2023/11/7	2023/12/15	medium
185421	SUSE SLES15 Security Update : squid (SUSE-SU-2023:4384-1)	Nessus	SuSE Local Security Checks	2023/11/9	2023/12/15	medium
204802	Photon OS 3.0: Squid PHSA-2023-3.0-0689	Nessus	PhotonOS Local Security Checks	2024/7/27	2024/7/27	high

检测

插件搜索

high

high

high

medium

medium

high

high

high

medium

high

critical

critical

high

high

medium

medium

medium

high