CVE-2023-46847

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-120"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46847.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "7:3.4.14-15.el6_10.1"
                        },
                        {
                            "fixed": "7:3.1.23-24.el6_10.1"
                        },
                        {
                            "fixed": "7:3.5.20-17.el7_9.9"
                        },
                        {
                            "fixed": "7:3.5.20-12.el7_6.2"
                        },
                        {
                            "fixed": "7:3.5.20-13.el7_7.1"
                        },
                        {
                            "fixed": "8080020231030214932.63b34585"
                        },
                        {
                            "fixed": "8090020231030224841.a75119d5"
                        },
                        {
                            "fixed": "8010020231101141358.c27ad7f8"
                        },
                        {
                            "fixed": "8020020231101135052.4cda2c84"
                        },
                        {
                            "fixed": "8020020231101135052.4cda2c84"
                        },
                        {
                            "fixed": "8020020231101135052.4cda2c84"
                        },
                        {
                            "fixed": "8040020231101101624.522a0ee4"
                        },
                        {
                            "fixed": "8040020231101101624.522a0ee4"
                        },
                        {
                            "fixed": "8040020231101101624.522a0ee4"
                        },
                        {
                            "fixed": "8060020231031165747.ad008a3a"
                        },
                        {
                            "fixed": "7:5.5-5.el9_2.1"
                        },
                        {
                            "fixed": "7:5.5-6.el9_3.1"
                        },
                        {
                            "fixed": "7:5.2-1.el9_0.3"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "InverseAffectedRanges"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type

GIT

Repo

https://github.com/squid-cache/squid

Events

Introduced

04c6f6c989fb0083b3b10adfe2f438b6781c43bd

Fixed

1d8175b27fc1c347649d4f221ff2633e8d800429

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.2.0.1"
                },
                {
                    "fixed": "6.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "cpe": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.2.0.1"
                },
                {
                    "fixed": "6.4"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46847.json"