PatchTheCVEsquid web proxy vulnerabilities and fixes
Recent CVEs affecting squid web proxy, with upgrade or downgrade steps. 4 tracked.
Also searched as: squidwebproxy.
squid web proxy has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2001-12-06. Highest priority: CVE-2001-1030 (score 51/100).
- CVE-2001-1030 HIGH 7.5 DOWNGRADE DOWNGRADE Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_ac
- CVE-2001-0843 MEDIUM 5.0 UPGRADE Squid proxy server 2.4 and earlier allows remote attackers to cause a denial of service (crash) via a mkdir-on
- CVE-2001-0142 LOW 1.2 DOWNGRADE DOWNGRADE squid 2.3 and earlier allows local users to overwrite arbitrary files via a symlink attack in some configurati
- CVE-1999-1481 MEDIUM 5.0 DOWNGRADE Squid 2.2.STABLE5 and below, when using external authentication, allows attackers to bypass access controls vi
FAQ
How do I fix squid web proxy vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is squid web proxy being exploited right now?
None of the tracked squid web proxy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which squid web proxy CVE should I patch first?
CVE-2001-1030 currently ranks highest (51/100): Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_ac.