CVE-2021-28116

 

Published at: - 09-03-2021 11:15

Last modified: - 28-06-2022 03:15

Total changes: - 7

Description

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/squid-cache/squid/security/advisories/GHSA-rgf3-9v3p-qp82
• http://www.squid-cache.org/Versions/
• https://www.zerodayinitiative.com/advisories/ZDI-21-157/
• GLSA-202105-14-Third Party Advisory
• FEDORA-2021-24af72ff2c-Mailing List, Third Party Advisory
• FEDORA-2021-c0bec55ec7-Mailing List, Third Party Advisory
• [oss-security] 20211004 CVE-2021-28116 / ZDI-CAN-11610 / SQUID-2020:12 Out-Of-Bounds memory access in WCCPv2-Mailing List, Third Party Advisory
• DSA-5171-

 

Keywords

NVD

 

CVE-2021-28116

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures