Bug 14132

Summary:	[CVE 21] squid 5.9 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Vladimir Potapov <v.potapov>
Component:	Packages from Main	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	blocker
Priority:	Highest	CC:	a.proklov, pastordidi
Version:	All	Flags:	v.potapov: qa_verified+ v.potapov: secteam_verified? a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2023-46724,CVE-2023-46728,CVE-2023-46847,CVE-2023-5824,CVE-2023-46848,CVE-2023-46846
Whiteboard:
Platform:	---	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Vladimir Potapov 2023-12-08 12:42:31 MSK

https://nvd.nist.gov/vuln/detail/CVE-2023-46724 high
https://nvd.nist.gov/vuln/detail/CVE-2023-46728 HIGH
https://nvd.nist.gov/vuln/detail/CVE-2023-46847 HIGH
https://nvd.nist.gov/vuln/detail/CVE-2023-5824 CRITICAL!
https://nvd.nist.gov/vuln/detail/CVE-2023-46848 HIGH
https://nvd.nist.gov/vuln/detail/CVE-2023-46846 CRITICAL!

Comment 1 Aleksandr Proklov 2023-12-11 07:02:44 MSK

CVE-2023-5824 патча для squid5 нет. Нужно использовать рекомендацию по настройке
из https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255
------------------
Workaround:

Disable disk caching by removing all cache_dir directives from
squid.conf.
------------------

Остальные уязвимости закрыты патчами

squid	5.9-2

https://abf.io/build_lists/4885140
https://abf.io/build_lists/4885141 х64
https://abf.io/build_lists/4885142
https://abf.io/build_lists/4885144

Comment 2 Dmitry Postnikov 2023-12-11 10:42:25 MSK

*****************************
Обновление отослано в Тестинг

Comment 3 Vladimir Potapov 2023-12-14 17:36:36 MSK

squid-5.9-2
https://abf.io/build_lists/4885140
https://abf.io/build_lists/4885141 х64
https://abf.io/build_lists/4885142
https://abf.io/build_lists/4885144
****************************** Advisory ***********************
CVE closed by patches
***************************************************************
QA Verified