CVE-2023-49286: squid-cache squid Incorrect Check of Function Return Value

Vulnerability summary

CVE-2023-49286 is a high (CVSS 8.6) Incorrect Check of Function Return Value vulnerability in squid-cache squid. EPSS estimates a 10.35% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities.

Timeline

1. 04-12-2023
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-253Incorrect Check of Function Return ValueThe product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.