CVE-2023-50269

一、漏洞信息
 漏洞编号：[CVE-2023-50269](https://nvd.nist.gov/vuln/detail/CVE-2023-50269)
 漏洞归属组件：[squid](https://gitee.com/src-openeuler/squid)
 漏洞归属的版本：4.9,5.7,6.1
 CVSS V3.0分值：
  BaseScore：8.6 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
 漏洞简述：
  Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid s patch archives.
 漏洞公开时间：2023-12-15 02:15:45
 漏洞创建时间：2023-12-15 02:38:31
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-50269
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch |  |
| security-advisories.github.com | http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch |  |
| security-advisories.github.com | https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3 |  |
| redhat_bugzilla | http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch | https://bugzilla.redhat.com/show_bug.cgi?id=2254663 |
| redhat_bugzilla | http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch | https://bugzilla.redhat.com/show_bug.cgi?id=2254663 |
| redhat_bugzilla | https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3 | https://bugzilla.redhat.com/show_bug.cgi?id=2254663 |
| squid |  | https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-50269 | https://explore.alas.aws.amazon.com/CVE-2023-50269.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269 | https://explore.alas.aws.amazon.com/CVE-2023-50269.html |
| snyk | https://github.com/squid-cache/squid/commit/567e77f6c37047b62dbb4e5afaf9e81f5bd5ae2b | https://security.snyk.io/vuln/SNYK-UNMANAGED-SQUID-6128854 |
| snyk | https://github.com/squid-cache/squid/commit/9f7136105bff920413042a8806cc5de3f6086d6d | https://security.snyk.io/vuln/SNYK-UNMANAGED-SQUID-6128854 |
| snyk | https://megamansec.github.io/Squid-Security-Audit/xff-stackoverflow.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-SQUID-6128854 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269 | https://ubuntu.com/security/CVE-2023-50269 |
| ubuntu | https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3 | https://ubuntu.com/security/CVE-2023-50269 |
| ubuntu | http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch | https://ubuntu.com/security/CVE-2023-50269 |
| ubuntu | http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch | https://ubuntu.com/security/CVE-2023-50269 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-50269 | https://ubuntu.com/security/CVE-2023-50269 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-50269 | https://ubuntu.com/security/CVE-2023-50269 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-50269 | https://ubuntu.com/security/CVE-2023-50269 |
| ubuntu | http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058721 | https://ubuntu.com/security/CVE-2023-50269 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/squid-cache/squid/commit/567e77f6c37047b62dbb4e5afaf9e81f5bd5ae2b |  | snyk |
|  |  | https://github.com/squid-cache/squid/commit/9f7136105bff920413042a8806cc5de3f6086d6d |  | snyk |
| squid |  | http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch |  | squid |
| squid |  | http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch |  | squid |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
            squid中存在不受控制的递归错误，容易受到针对HTTP请求解析的拒绝服务攻击。配置follow_x_forwarded_for功能后，允许远程客户端通过发送大型X-Forwarded-For标头来执行拒绝服务攻击。     
 openEuler评分：
  8.6
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.9):受影响
2.openEuler-20.03-LTS-SP3(4.9):受影响
3.openEuler-20.03-LTS-SP4:受影响
4.openEuler-22.03-LTS(4.9):受影响
5.openEuler-22.03-LTS-SP1(4.9):受影响
6.openEuler-22.03-LTS-SP2(4.9):受影响
7.openEuler-22.03-LTS-SP3:受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.9):否
2.openEuler-20.03-LTS-SP3(4.9):否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS(4.9):否
5.openEuler-22.03-LTS-SP1(4.9):否
6.openEuler-22.03-LTS-SP2(4.9):否
7.openEuler-22.03-LTS-SP3:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1947

src-openEuler/squid
关闭

内容风险标识

评论 (12)

src-openEuler/squid关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-50269

评论 (12)

搜索帮助

src-openEuler/squid
关闭