The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-1376 advisory.

    - Resolves: RHEL-19555 - squid: denial of service in HTTP request       parsing (CVE-2023-50269)
    - Resolves: RHEL-28614 - squid: Denial of Service in HTTP Chunked       Decoding (CVE-2024-25111)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1375 advisory.

    * squid: denial of service in HTTP header parser (CVE-2024-25617)

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-7624:02 advisory.

    * squid: denial of service in HTTP header parser (CVE-2024-25617)
      * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)
      * squid: denial of service in HTTP request parsing (CVE-2023-50269)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the squid package has been released.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-467 advisory.

    Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through     2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial     of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of     Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is     configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. (CVE-2023-50269)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6594-1 advisory.

    Joshua Rogers discovered that Squid incorrectly handled HTTP message processing. A remote attacker could     possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-49285)

    Joshua Rogers discovered that Squid incorrectly handled Helper process management. A remote attacker could     possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-49286)

    Joshua Rogers discovered that Squid incorrectly handled HTTP request parsing. A remote attacker could     possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-50269)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17.54. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1916 advisory.

    Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through     2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial     of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of     Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is     configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. (CVE-2023-50269)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0455-1 advisory.

    - CVE-2023-50269: fixed X-Forwarded-For Stack Overflow. (bsc#1217654)
    - CVE-2024-23638: fixed Denial of Service attack against Cache Manager error responses. (bsc#1219131)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1376 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: denial of service in HTTP header parser (CVE-2024-25617)

    * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1787 advisory.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests. (CVE-2023-46728)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of     Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process     management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-49286)

  - Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through     2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial     of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of     Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is     configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. (CVE-2023-50269)

  - Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse     of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header     parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending     oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the     request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version     6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in     cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time     prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5.
    There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2     (CVE-2024-25617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0772 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18253)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0771 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18255)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
192315	Oracle Linux 9 : squid (ELSA-2024-1376)	Nessus	Oracle Linux Local Security Checks	2024/3/20	2025/9/9	high
235552	RockyLinux 8 : squid:4 (RLSA-2024:1375)	Nessus	Rocky Linux Local Security Checks	2025/5/7	2025/5/7	high
293139	MiracleLinux 9 : squid-5.5-6.el9_3.8 (AXSA:2024-7624:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
204425	Photon OS 4.0: Squid PHSA-2024-4.0-0538	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
187691	Amazon Linux 2023 : squid (ALAS2023-2024-467)	Nessus	Amazon Linux Local Security Checks	2024/1/8	2024/12/11	high
189360	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Squid vulnerabilities (USN-6594-1)	Nessus	Ubuntu Local Security Checks	2024/1/23	2024/8/27	high
190025	Amazon Linux AMI : squid (ALAS-2024-1916)	Nessus	Amazon Linux Local Security Checks	2024/2/6	2024/12/11	high
190631	SUSE SLES15 / openSUSE 15 Security Update : squid (SUSE-SU-2024:0455-1)	Nessus	SuSE Local Security Checks	2024/2/17	2026/6/25	high
192264	RHEL 9 : squid (RHSA-2024:1376)	Nessus	Red Hat Local Security Checks	2024/3/19	2025/4/10	high
208495	CentOS 7 : squid (RHSA-2024:1787)	Nessus	CentOS Local Security Checks	2024/10/9	2025/1/10	high
190402	RHEL 8 : squid:4 (RHSA-2024:0772)	Nessus	Red Hat Local Security Checks	2024/2/12	2025/8/27	critical
190404	RHEL 8 : squid:4 (RHSA-2024:0771)	Nessus	Red Hat Local Security Checks	2024/2/12	2025/8/27	critical
332521	Photon OS 5.0: Squid PHSA-2024-5.0-91-0185	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high

critical

critical

high