7.5

CVE-2018-1000024

EPSS 9.02%
Published 09.02.2018 23:29:00
Last modified 21.11.2024 03:39:27
Source cve@mitre.org
Teams watchlist Login
Open Login

The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.

Affected products Warnungen 0 Metrics 3 CWE 0 References 9

Data is provided by the National Vulnerability Database (NVD)

Squid-cache ≫ Squid Version >= 3.0 <= 3.5.27

Squid-cache ≫ Squid Version >= 4.0 <= 4.0.22

Debian ≫ Debian Linux Version7.0

Debian ≫ Debian Linux Version8.0

Debian ≫ Debian Linux Version9.0

Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version17.10

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	9.02%	0.923

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

https://usn.ubuntu.com/3557-1/

Third Party Advisory

http://www.squid-cache.org/Advisories/SQUID-2018_1.txt

Patch

Vendor Advisory

http://www.squid-cache.org/Versions/

Vendor Advisory

Release Notes

https://lists.debian.org/debian-lts-announce/2018/02/msg00001.html

Third Party Advisory

Mailing List

https://usn.ubuntu.com/4059-2/

https://www.debian.org/security/2018/dsa-4122

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-1000024

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-1000024

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-1000024

EUVD