Improper input validation in Squid-Cache Squid
CVE-2009-2622
Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.569 (99.0th percentile) — read the EPSS interpretation.
Affected products
- Squid-cache Squid — versions 3.0, 3.1, 3.1.0.1
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (vdb-entry, x_refsource_SECTRACK)
- cret@cert.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cret@cert.org (vdb-entry, x_refsource_BID)
- cret@cert.org (vdb-entry, x_refsource_VUPEN)
- cret@cert.org (x_refsource_SECUNIA, third-party-advisory)
- cret@cert.org (x_refsource_CONFIRM, Vendor Advisory)
- cret@cert.org (vendor-advisory, x_refsource_MANDRIVA)
- cret@cert.org (vendor-advisory, x_refsource_MANDRIVA)