This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-28116 →
Unrated
Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data...
UBUNTU-CVE-2021-28116
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | squid3 |
All versions |
— |
| Ubuntu:18.04:LTS | squid3 |
< 3.5.27-1ubuntu1.12 |
3.5.27-1ubuntu1.12 |
| Ubuntu:20.04:LTS | squid |
< 4.10-1ubuntu1.5 |
4.10-1ubuntu1.5 |
| Ubuntu:22.04:LTS | squid |
< 4.13-10ubuntu5 |
4.13-10ubuntu5 |
Original description The description as published by the source.
Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- advisory ubuntu.com
- report ubuntu.com
- report zerodayinitiative.com
- report squid-cache.org
- report github.com
- report openwall.com
- report cve.org