Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 858845 (CVE-2021-46784)

Summary: <net-proxy/squid-5.7: DoS via long Gopher server responses
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: hlein, hydrapolic, maintainer-needed, mgorny, proxy-maint, sam, zlogene
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://github.com/squid-cache/squid/security/advisories/GHSA-f5cp-6rh3-284w
Whiteboard: B3 [noglsa]
Package list:
Runtime testing required: ---
Bug Depends on: 889958    
Bug Blocks:    

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-18 17:49:54 UTC
CVE-2021-46784:

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
Comment 1 Larry the Git Cow gentoo-dev 2022-09-29 02:15:01 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=69e685162ba2ccf86cf04e7ba544718bc9ae41d4

commit 69e685162ba2ccf86cf04e7ba544718bc9ae41d4
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-09-24 06:19:24 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-09-29 02:14:37 +0000

    net-proxy/squid: add 5.7
    
    Bug: https://bugs.gentoo.org/858845
    Bug: https://bugs.gentoo.org/872551
    Closes: https://bugs.gentoo.org/706126
    Closes: https://bugs.gentoo.org/869968
    Signed-off-by: Sam James <sam@gentoo.org>

 net-proxy/squid/Manifest         |   1 +
 net-proxy/squid/squid-5.7.ebuild | 362 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 363 insertions(+)
Comment 2 Hank Leininger 2024-02-06 23:03:53 UTC
This has been long since fixed, can this bug be closed please?
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-02-06 23:08:51 UTC
commit 8b6de11b7479f646a9f935ca3295aae637b124aa
Author: Hank Leininger <hlein@korelogic.com>
Date:   Sat Jun 17 12:34:30 2023 -0600

    net-proxy/squid: drop 4.17-r1

    Signed-off-by: Hank Leininger <hlein@korelogic.com>
    Closes: https://github.com/gentoo/gentoo/pull/31518
    Signed-off-by: Sam James <sam@gentoo.org>