Ubuntu Security Notice 5641-1 - Mikhail Evdokimov discovered that Squid incorrectly handled cache manager ACLs. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. It was discovered that Squid incorrectly handled SSPI and SMB authentication. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly obtain sensitive information.
e3be1c2d3e1c33766fc12005e97a52783721d5bebbcafa1253447b986f555895
==========================================================================
Ubuntu Security Notice USN-5641-1
September 26, 2022
squid, squid3 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in Squid.
Software Description:
- squid: Web proxy cache server
- squid3: Web proxy cache server
Details:
Mikhail Evdokimov discovered that Squid incorrectly handled cache manager
ACLs. A remote attacker could possibly use this issue to obtain sensitive
information. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04
LTS. (CVE-2022-41317)
It was discovered that Squid incorrectly handled SSPI and SMB
authentication. A remote attacker could use this issue to cause Squid to
crash, resulting in a denial of service, or possibly obtain sensitive
information. (CVE-2022-41318)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
squid 5.2-1ubuntu4.2
Ubuntu 20.04 LTS:
squid 4.10-1ubuntu1.7
Ubuntu 18.04 LTS:
squid 3.5.27-1ubuntu1.14
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5641-1
CVE-2022-41317, CVE-2022-41318
Package Information:
https://launchpad.net/ubuntu/+source/squid/5.2-1ubuntu4.2
https://launchpad.net/ubuntu/+source/squid/4.10-1ubuntu1.7
https://launchpad.net/ubuntu/+source/squid3/3.5.27-1ubuntu1.14