Description
The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.
References (6)
Core 6
Core References
Vendor Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/4059-2/
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/3557-1/
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2018/dsa-4122
Release Notes, Vendor Advisory x_refsource_misc
http://www.squid-cache.org/Versions/
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/02/msg00001.html
Patch, Vendor Advisory x_refsource_confirm
http://www.squid-cache.org/Advisories/SQUID-2018_1.txt
Scores
CVSS v3
7.5
EPSS
0.0808
EPSS Percentile
94.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
Status
published
Products (7)
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
17.10
debian/debian_linux
7.0
debian/debian_linux
8.0
debian/debian_linux
9.0
squid-cache/squid
3.0 - 3.5.27
Published
Feb 09, 2018
Tracked Since
Feb 18, 2026