CVE-2022-41318

Name of the Vulnerable Software and Affected Versions Squid versions 2.5 through 5.6

Description A buffer over-read was discovered in libntlmauth due to incorrect integer-overflow protection, making the SSPI and SMB authentication helpers vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client.

Recommendations For Squid versions 2.5 through 5.6, update to version 5.7 to resolve the issue. As a temporary workaround, consider restricting access to the SSPI and SMB authentication helpers until a patch is available. Avoid using configurations that may send cleartext credentials to a client.