CVE-2018-1000027
mediumPriorität · verfolgen · 35EPSS 0.129 · 96. PerzentilEURUUSEPSS · bewertet 2026-10-27
The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobensquid-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-7:3.5.20-15.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-7:3.5.20-15.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-debuginfo-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-migration-script-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-migration-script-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-migration-script-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-migration-script-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-migration-script-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-sysvinit-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-sysvinit-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-sysvinit-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-sysvinit-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Behobensquid-sysvinit-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:1068 - Workaroundsquid-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-7:3.5.20-15.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-7:3.5.20-15.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-debuginfo-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-migration-script-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-migration-script-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-migration-script-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-migration-script-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-migration-script-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-sysvinit-7:3.5.20-15.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-sysvinit-7:3.5.20-15.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-sysvinit-7:3.5.20-15.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-sysvinit-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
- Workaroundsquid-sysvinit-7:3.5.20-15.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)redhat_csaf
A workaround for this issue is to set the "log_uses_indirect_client off" configuration directive in the squid configuration file (for example /etc/squid/squid.conf).
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (37)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- RHSA-2020:1068Red Hat Security Advisory: squid security and bug fix update2020-03-31csaf · redhat_csafUS
An update for squid is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 22 October 2020] This update was found to introduce a bug in cachemgr.cgi that could prevent access to the cache manager. This is not a security regression. The fix is being tracked in https://bugzilla.redhat.com/show_bug.cgi?id=1890581
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (30)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.squid-cache.org/Advisories/SQUID-2018_2.txtcnnvd
- http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patchcnnvd
- http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patchcnnvd
- https://github.com/squid-cache/squid/pull/129/filescnnvd
- https://lists.debian.org/debian-lts-announce/2018/02/msg00001.htmlcnnvd
- https://lists.debian.org/debian-lts-announce/2018/02/msg00002.htmlcnnvd
- https://packetstormsecurity.com/files/153676/Ubuntu-Security-Notice-USN-4059-2.htmlcnnvd
- https://packetstormsecurity.com/files/170190/Ubuntu-Security-Notice-USN-5771-1.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan