5.9

CVE-2018-1172: squid-cache squid NULL Pointer Dereference

CVSS: 5.9v3.0MediumModified
AliasesALPINE-CVE-2018-1172SUSE-SU-2018:1122-1SUSE-SU-2018:1365-1
Published 16-05-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-1172 is a medium (CVSS 5.9) NULL Pointer Dereference vulnerability in squid-cache squid. EPSS estimates a 8.31% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.0 (NVD)
EPSS score
8.31%
0%100%
Low · -0.30 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:11403-1

Timeline

  1. 16-05-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

8.31%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

-0.30 pp

From 8.61% on 18-09-2026

18-09-202618-10-2026
EPSS score
8.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse4 products
  • squid3&distro=SUSE Linux Enterprise Server 11 SP4< 3.1.23-8.16.37.6.1
  • squid3&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 3.1.23-8.16.37.6.1
  • squid&distro=SUSE Linux Enterprise Server 12 SP3< 3.5.21-26.9.1
  • squid&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 3.5.21-26.9.1
Alpine1 product
  • squid< 3.5.27-r2
Debian1 product
  • squid< 4.1-1
Squid-cache1 product
The squid software foundation1 product

5 vendors · 8 products

References

8 links