9.3

CVE-2023-46846

Squid: request/response smuggling in http/1.1 and icap

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Squid-cache ≫ Squid Version >= 2.6 < 6.4
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Version9.0
Redhat ≫ Enterprise Linux Eus Version8.6
Redhat ≫ Enterprise Linux Eus Version8.8
Redhat ≫ Enterprise Linux Eus Version9.0
Redhat ≫ Enterprise Linux Eus Version9.2
Redhat ≫ Enterprise Linux For Arm 64 Version8.0_aarch64
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.26% 0.915
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
secalert@redhat.com 9.3 3.9 4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

https://access.redhat.com/errata/RHSA-2023:6266
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6267
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6268
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6748
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6801
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6803
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6804
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6810
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7213
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:11049
https://access.redhat.com/security/cve/CVE-2023-46846
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2245910
Third Party Advisory
Issue Tracking
https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
https://lists.debian.org/debian-lts-announce/2024/01/msg00008.html
https://security.netapp.com/advisory/ntap-20231130-0002/