PT-2023-8580
CVE-2023-46728
·
تاريخ النشر
2023-09-26
·
تاريخ التحديث
2025-09-27
الوصف من
CVSS 2.0
7.8
عاليةالمقاييسAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions
Squid versions prior to 6.0.1
Description
The issue is related to a NULL pointer dereference bug in Squid's Gopher gateway, making it vulnerable to a Denial of Service attack. The gopher protocol is always available and enabled in Squid prior to version 6.0.1. Responses that trigger this bug can be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1.
Recommendations
For Squid versions prior to 6.0.1, users are advised to upgrade to version 6.0.1 or later to resolve the issue.
As a temporary workaround for users unable to upgrade, reject all gopher URL requests to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾