The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6569:04 advisory.

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4380-1 advisory.

    - CVE-2023-46846: Request/Response smuggling in HTTP/1.1 and ICAP (bsc#1216500).
    - CVE-2023-46847: Denial of Service in HTTP Digest Authentication (bsc#1216495).
    - CVE-2023-46724: Fix validation of certificates with CN=* (bsc#1216803).
    - CVE-2023-46848: Denial of Service in FTP (bsc#1216498).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4384-1 advisory.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

  - SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.
    (CVE-2023-46846)

  - Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication. (CVE-2023-46847)

  - Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs     in HTTP Request messages or constructing ftp:// URLs from FTP Native input. (CVE-2023-46848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2318 advisory.

    An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to     see if the request should be denied. Squid by default comes with rules to block access to the Cache     Manager, which serves detailed server information meant for the maintainer. This rule is implemented via     url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to     encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)

    An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When     Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.
    uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The     length is then used to start decoding the string. There are no checks to ensure that the length it     calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An     attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the     display of usernames on error pages. (CVE-2019-12529)

    An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because     the appended characters do not properly interact with hostname length restrictions). Due to incorrect     message processing, it can inappropriately redirect traffic to origins it should not be delivered to.
    (CVE-2019-18677)

    An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests     through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The     resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content     at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no     effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing     whitespace between a header name and a colon. (CVE-2019-18678)

    Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter     to cachemgr.cgi. (CVE-2019-18860)

    Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of     an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code     execution as nobody. (CVE-2021-28116)

    Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest     Authentication (CVE-2023-46847)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6266 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    * SQUID-2023:5 squid: denial of Service in FTP (CVE-2023-46848)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:6267 advisory.

    * SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)
    * SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6804 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6266 advisory.

  - SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.
    (CVE-2023-46846)

  - Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication. (CVE-2023-46847)

  - Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs     in HTTP Request messages or constructing ftp:// URLs from FTP Native input. (CVE-2023-46848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7213 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the squid package has been released.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0135 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-46846:
    SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.

    CVE-2023-46847:
    Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0277 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-46846:
      SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.

      CVE-2023-46847:
      Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack     by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0289 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-46846:
      SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.

      CVE-2023-46847:
      Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack     by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6575:01 advisory.

    * SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)
      * SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0039 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-46724:
    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages.

    CVE-2023-46846:
    SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote     attacker to perform Request/Response smuggling past firewall and frontend security systems.

    CVE-2023-46847:
    Squid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication.

    CVE-2023-46848:
    Squid is vulnerable to Denial of Service,  where a remote attacker can perform DoS by sending ftp:// URLs     in HTTP Request messages or constructing ftp:// URLs from FTP Native input.

    CVE-2023-46728:
    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests.

    CVE-2023-5824:
    Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling     of Structural Elements bug.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6560:03 advisory.

    * SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)
      * SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)
      * SQUID-2023:5 squid: denial of Service in FTP (CVE-2023-46848)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
291810	MiracleLinux 7 : squid-3.5.20-17.el7.9 (AXSA:2023-6569:04)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
184793	SUSE SLES15 / openSUSE 15 Security Update : squid (SUSE-SU-2023:4380-1)	Nessus	SuSE Local Security Checks	2023/11/7	2026/6/26	medium
185421	SUSE SLES15 Security Update : squid (SUSE-SU-2023:4384-1)	Nessus	SuSE Local Security Checks	2023/11/9	2023/12/15	medium
183925	Amazon Linux 2 : squid (ALAS-2023-2318)	Nessus	Amazon Linux Local Security Checks	2023/10/26	2024/12/11	critical
184205	RHEL 9 : squid (RHSA-2023:6266)	Nessus	Red Hat Local Security Checks	2023/11/2	2025/3/6	medium
184445	AlmaLinux 8 : squid:4 (ALSA-2023:6267)	Nessus	Alma Linux Local Security Checks	2023/11/6	2025/1/13	medium
185363	RHEL 8 : squid:4 (RHSA-2023:6804)	Nessus	Red Hat Local Security Checks	2023/11/8	2024/11/8	medium
185472	Rocky Linux 9 : squid (RLSA-2023:6266)	Nessus	Rocky Linux Local Security Checks	2023/11/11	2023/12/15	medium
185671	RHEL 8 : squid:4 (RHSA-2023:7213)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/3/6	medium
204802	Photon OS 3.0: Squid PHSA-2023-3.0-0689	Nessus	PhotonOS Local Security Checks	2024/7/27	2024/7/27	high
236673	Alibaba Cloud Linux 3 : 0135: squid:4 (ALINUX3-SA-2023:0135)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
238912	TencentOS Server 3: squid:4 (TSSA-2023:0277)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	medium
239785	TencentOS Server 3: squid:4 (TSSA-2023:0289)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	medium
292324	MiracleLinux 8 : squid:4 (AXSA:2023-6575:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
239315	TencentOS Server 4: squid (TSSA-2024:0039)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
293581	MiracleLinux 9 : squid-5.5-5.el9.1 (AXSA:2023-6560:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

high

medium

medium

critical

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium