| Summary: | [CVE 21] squid 5.9 CVEs -2 | ||
|---|---|---|---|
| Product: | [ROSA-based products] ROSA Fresh | Reporter: | Vladimir Potapov <v.potapov> |
| Component: | Packages from Main | Assignee: | ROSA Linux Bugs <bugs> |
| Status: | VERIFIED FIXED | QA Contact: | ROSA Linux Bugs <bugs> |
| Severity: | critical | ||
| Priority: | Highest | CC: | a.proklov, i.gaptrakhmanov, pastordidi |
| Version: | All | Flags: | v.potapov:
qa_verified+
v.potapov: secteam_verified? a.proklov: published+ |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | CVE-2023-49285,CVE-2023-49286,CVE-2023-49288,CVE-2023-5824 | ||
| Whiteboard: | |||
| Platform: | --- | ROSA Vulnerability identifier: | |
| RPM Package: | ISO-related: | ||
| Bad POT generating: | Upstream: | ||
|
Description
Vladimir Potapov
2024-01-12 12:10:25 MSK
******** QA ADVISORY ******** CVE-2023-49285 уже исправлен в патче SQUID-2023_7.patch. Информация добавлена в спек файл. CVE-2023-49286 - для 5-ой ветки нет патча исправления. https://security-tracker.debian.org/tracker/CVE-2023-49286 CVE-2023-49288 - исправлено только с версии 6.0.1, однако: https://ubuntu.com/security/CVE-2023-49288 All versions of Squid from 3.5 up to and including 5.9 configured with “collapsed_forwarding on” are vulnerable. Configurations with “collapsed_forwarding off” or without a “collapsed_forwarding” directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf. * В нашем конфиге отсутсвуют строки содержащие collapsed_forwarding * Дополнительно убедиться можно командой `sudo squid -k parse 2>&1 | grep collapsed` CVE-2023-5824 - для 5-ой ветки патчей исправления нет: https://ubuntu.com/security/CVE-2023-5824 as of 2023-12-05, this is not fixed in the upstream 5.x repository. The patches to fix this issue are large and intrusive. Per the researcher's advisory, "Of course, such 'attacks' are completely theoretical and are only considered for entertainment purposes." # rosa2021.1 https://abf.rosalinux.ru/build_lists/4955807 i686 https://abf.rosalinux.ru/build_lists/4955809 x86_64 https://abf.rosalinux.ru/build_lists/4955811 aarch64 https://abf.rosalinux.ru/build_lists/4955815 e2kv4 # rosa2021.15 https://abf.rosalinux.ru/build_lists/4955817 i686 https://abf.rosalinux.ru/build_lists/4955818 x86_64 https://abf.rosalinux.ru/build_lists/4955819 aarch64 https://abf.rosalinux.ru/build_lists/4955820 e2kv4 ***************************** Обновление отослано в Тестинг вчера в 2021.1 Сегодня опубликовал в 2021.15 squid-5.9-3 https://abf.rosalinux.ru/build_lists/4955807 i686 https://abf.rosalinux.ru/build_lists/4955809 x86_64 https://abf.rosalinux.ru/build_lists/4955811 aarch64 https://abf.rosalinux.ru/build_lists/4955815 e2kv4 ******************************* Advisory ***************************** CVE fixes ********************************************************************** QA Verified |