RHSA-2024:0771HighCVSS 8.9

Red Hat Security Advisory: squid:4 security update

Published
February 12, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (7)

CVE-2023-49285 →CVE-2023-49286 →CVE-2023-50269 →CVE-2025-54574 →CVE-2023-5824 →CVE-2023-46724 →CVE-2023-46728 →

📋 Description

CVE-2023-5824 — squid: DoS against HTTP and HTTPS CVE-2023-46724 — squid: Denial of Service in SSL Certificate validation CVE-2023-46728 — squid: NULL pointer dereference in the gopher protocol code CVE-2023-49285 — squid: Buffer over-read in the HTTP Message processing feature CVE-2023-49286 — squid: Incorrect Check of Function Return Value In Helper Process management CVE-2023-50269 — squid: denial of service in HTTP request parsing CVE-2025-54574 — squid-cache: Squid Buffer Overflow

🎯 Affected products31

  • Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.aarch64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.s390x (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.src (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-debuginfo-0:1.0.1-2.module+el8.1.0+4044+36416a77.aarch64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-debuginfo-0:1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-debuginfo-0:1.0.1-2.module+el8.1.0+4044+36416a77.s390x (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-debuginfo-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-debugsource-0:1.0.1-2.module+el8.1.0+4044+36416a77.aarch64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-debugsource-0:1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-debugsource-0:1.0.1-2.module+el8.1.0+4044+36416a77.s390x (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-debugsource-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.aarch64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.s390x (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libecap-devel-0:1.0.1-2.module+el8.1.0+4044+36416a77.x86_64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.aarch64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.ppc64le (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.s390x (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.src (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.x86_64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-debuginfo-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.aarch64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-debuginfo-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.ppc64le (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-debuginfo-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.s390x (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-debuginfo-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.x86_64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-debugsource-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.aarch64 (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-debugsource-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.ppc64le (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • squid-debugsource-7:4.15-3.module+el8.6.0+21069+a1561e3d.4.s390x (squid:4) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • +1 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically. Workaround: Disabling the disk caching mechanism will mitigate this vulnerability. To achieve this, remove all the 'cache_dir' directives from the Squid configuration, typically in the /etc/squid/squid.conf file. Workaround: Disable the use of SSL-Bump features: - Remove all ssl-bump options from http_port and https_port - Remove all ssl_bump directives from squid.conf Workaround: To mitigate this issue, create an access list configuration to reject all gopher URL requests: Set ACL directives in your squid.conf file (or equivalent) as follows: acl gopher proto gopher http_access deny gopher Important: This sequence must be placed above any lines starting with "http_access allow" in your configuration. Observation: Some loss of performance may occur with this configuration. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Remove all "follow_x_forwarded_for" lines from squid.conf. Workaround: Users can disable URN access permissions to mitigate this issue.

🔗 References (9)