CVE-2024-37894

NameCVE-2024-37894
DescriptionSquid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5751-1
Debian Bugs1074284

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)buster (security), buster, buster (lts)4.6-1+deb10u10vulnerable
bullseye (security), bullseye4.13-10+deb11u3vulnerable
bookworm (security), bookworm5.7-2+deb12u2fixed
sid, trixie6.12-1fixed
squid3 (PTS)jessie, jessie (lts)3.5.23-5+deb8u7vulnerable
stretch (security)3.5.23-5+deb9u7vulnerable
stretch (lts), stretch3.5.23-5+deb9u10vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsourcebookworm5.7-2+deb12u2DSA-5751-1
squidsource(unstable)6.10-11074284
squid3source(unstable)(unfixed)

Notes

https://github.com/squid-cache/squid/commit/920563e7a080155fae3ced73d6198781e8b0ff04 (master)
https://github.com/squid-cache/squid/commit/67f5496f7b72e698ad0f5aa3512c83089424f27f (v6)
https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg

Search for package or bug name: Reporting problems