Ubuntu 21.04: USN-4981-1 Critical Denial Of Service Threats in Squid

ubuntu

June 3, 2021

Several security issues were fixed in Squid.

Summary

Several security issues were fixed in Squid.

Software Description:

- squid: Web proxy cache server

- squid3: Web proxy cache server

Details:

Joshua Rogers discovered that Squid incorrectly handled requests with the

urn: scheme. A remote attacker could possibly use this issue to cause

Squid to consume resources, leading to a denial of service.

(CVE-2021-28651)

Joshua Rogers discovered that Squid incorrectly handled requests to the

Cache Manager API. A remote attacker with access privileges could possibly

use this issue to cause Squid to consume resources, leading to a denial of

service. This issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 20.10,

and Ubuntu 21.04. (CVE-2021-28652)

Joshua Rogers discovered that Squid incorrectly handled certain response

headers. A remote attacker could possibly use this issue to cause Squid to

crash, resulting in a denial of service. This issue was only affected

Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-20...

Read the Full Advisory

Topics Covered

security advisory denial of service critical issue squid ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.04:
  squid                           4.13-1ubuntu4.1

Ubuntu 20.10:
  squid                           4.13-1ubuntu2.2

Ubuntu 20.04 LTS:
  squid                           4.10-1ubuntu1.4

Ubuntu 18.04 LTS:
  squid                           3.5.27-1ubuntu1.11

In general, a standard system update will make all the necessary changes.