CVE-2018-1172

MEDIUM

Squid 3.5.27-20180318 - DoS via Null Pointer Dereference in ClientRequestContext::sslBumpAccessCheck()

Title source: llm

Description

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry x_refsource_misc

https://zerodayinitiative.com/advisories/ZDI-18-309

Vendor Advisory x_refsource_confirm

http://www.squid-cache.org/Advisories/SQUID-2018_3.txt

Scores

CVSS v3 5.9

EPSS 0.0894

EPSS Percentile 94.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-476

Status published

Products (1)

squid-cache/squid 3.5.27

Published May 16, 2018

Tracked Since Feb 18, 2026