Paper/Archive/CVE-2023-46846

CVE-2023-46846

Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support — Squid: request/response smuggling in http/1.1 and icap

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 94.3.943 × 2018.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

Affected

ProductAffectedFixed inSource

squid2.6 – < 6.46.4CNA

Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory7:3.5.20-17.el7_9.13CNA

Red Hat Enterprise Linux 8see advisory8080020231030214932.63b34585CNA

Red Hat Enterprise Linux 8see advisory8090020231030224841.a75119d5CNA

Red Hat Enterprise Linux 8.1 Update Services for SAP Solutionssee advisory8010020231101141358.c27ad7f8CNA

Red Hat Enterprise Linux 8.2 Advanced Update Supportsee advisory8020020231101135052.4cda2c84CNA

Red Hat Enterprise Linux 8.2 Telecommunications Update Servicesee advisory8020020231101135052.4cda2c84CNA

Red Hat Enterprise Linux 8.2 Update Services for SAP Solutionssee advisory8020020231101135052.4cda2c84CNA

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory8040020231101101624.522a0ee4CNA

Red Hat Enterprise Linux 8.4 Telecommunications Update Servicesee advisory8040020231101101624.522a0ee4CNA

Red Hat Enterprise Linux 8.4 Update Services for SAP Solutionssee advisory8040020231101101624.522a0ee4CNA

Red Hat Enterprise Linux 8.6 Extended Update Supportsee advisory8060020231031165747.ad008a3aCNA

Scores by source

redhat (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References