{
  "threat_severity" : "Moderate",
  "public_date" : "2024-06-25T00:00:00Z",
  "bugzilla" : {
    "description" : "squid: Out-of-bounds write error may lead to Denial of Service",
    "id" : "2294353",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2294353"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-787",
  "details" : [ "Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.", "A flaw was found in Squid. An out-of-bounds write can be triggered when an Edge Side Includes (ESI) variable is assigned to a value not in the standard ASCII range, for example, multi-byte characters. This flaw allows a trusted server to crash Squid while processing an ESI response content, resulting in a denial of service." ],
  "statement" : "Squid as shipped in Red Hat Enterprise Linux 8 and 9 is vulnerable to this vulnerability as the ESI support is enabled by default.\nThis flaw requires Squid to be in a reverse proxy configuration and using an ESI variable with non ASCII characters, allowing a trusted server to cause a denial of service. For these reasons, this flaw was rated with a Moderate severity.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-07-25T00:00:00Z",
    "advisory" : "RHSA-2024:4861",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "squid-7:5.5-13.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-08-27T00:00:00Z",
    "advisory" : "RHSA-2024:5906",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2",
    "package" : "squid-7:5.5-5.el9_2.7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "squid34",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Will not fix",
    "package_name" : "squid:4/squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-37894\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-37894\nhttps://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg\nhttps://megamansec.github.io/Squid-Security-Audit/esi-underflow.html" ],
  "name" : "CVE-2024-37894",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}