This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2022-41318 →

ALPINE-CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authenticati...

Original description

The description as published by the source.

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.15 squid

[{"type":"ECOSYSTEM","events":[{"introduced":"2.5"},{"fixed":"5.2-r1"}]}]

Alpine:v3.16 squid

[{"type":"ECOSYSTEM","events":[{"introduced":"2.5"},{"fixed":"5.2-r1"}]}]

References

advisory security.alpinelinux.org