CVE-2020-11945

high-risk

Published 2020-04-23

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).

Do I need to act?

28.5% chance of exploitation in next 30 days

EPSS score — higher than 72% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: 1683cc19eea84e522beb463d00358a4265989f90, 3953412ebd17d99eb6bab35695880d4b09c4ac2d, eeebf0f37a72a2de08348e85ae34b02c34e9a811

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (11)

Squid

Debian Linux

Leap

Fedora

Ubuntu Linux

Affected Vendors

Debian Canonical Squid-Cache Fedoraproject Opensuse

References (30)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html

Vendor Advisory http://master.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de083...

Mailing List http://www.openwall.com/lists/oss-security/2020/04/23/2

Patch http://www.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e...

Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1170313

Patch https://github.com/squid-cache/squid/commit/eeebf0f37a72a2de08348e85ae34b02c34e9...

Patch https://github.com/squid-cache/squid/pull/585

Mailing List https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202005-05

Third Party Advisory https://security.netapp.com/advisory/ntap-20210304-0004/

Third Party Advisory https://usn.ubuntu.com/4356-1/

Third Party Advisory https://www.debian.org/security/2020/dsa-4682

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html

Vendor Advisory http://master.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de083...

Mailing List http://www.openwall.com/lists/oss-security/2020/04/23/2

Patch http://www.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e...

Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1170313

and 10 more references

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 15/34 · Moderate

Exposure 16/34 · Moderate