CVE-2021-28116 - log back

CVE-2021-28116 edited at 04 Oct 2021 08:15:14
Description
- Squid, in some configurations, allows information disclosure because of an out-of-bounds read in WCCPv2 protocol data. This problem allows a WCCPv2 sender to corrupt Squids list of known WCCP routers and divert client traffic to attacker controlled routers.
+ Squid before version 5.2, in some configurations, allows information disclosure because of an out-of-bounds read in WCCPv2 protocol data. This problem allows a WCCPv2 sender to corrupt Squids list of known WCCP routers and divert client traffic to attacker controlled routers.
CVE-2021-28116 edited at 04 Oct 2021 08:14:25
Severity
- Medium
+ High
Description
- Squid, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.
+ Squid, in some configurations, allows information disclosure because of an out-of-bounds read in WCCPv2 protocol data. This problem allows a WCCPv2 sender to corrupt Squids list of known WCCP routers and divert client traffic to attacker controlled routers.
References
+ https://github.com/squid-cache/squid/security/advisories/GHSA-rgf3-9v3p-qp82
https://www.zerodayinitiative.com/advisories/ZDI-21-157/
- https://github.com/squid-cache/squid/security/advisories/GHSA-rgf3-9v3p-qp82
https://bugs.squid-cache.org/show_bug.cgi?id=5131
+ https://www.squid-cache.org/Versions/v5/changesets/squid-5-7a73a54cefff6bb83c03de219a73276e42d183d0.patch
CVE-2021-28116 edited at 23 Jul 2021 10:41:20
Description
- Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.
+ Squid, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.
References
https://www.zerodayinitiative.com/advisories/ZDI-21-157/
https://github.com/squid-cache/squid/security/advisories/GHSA-rgf3-9v3p-qp82
+ https://bugs.squid-cache.org/show_bug.cgi?id=5131
CVE-2021-28116 edited at 10 Mar 2021 08:04:42
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Information disclosure
Description
+ Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.
References
+ https://www.zerodayinitiative.com/advisories/ZDI-21-157/
+ https://github.com/squid-cache/squid/security/advisories/GHSA-rgf3-9v3p-qp82
Notes
CVE-2021-28116 created at 10 Mar 2021 08:01:16