NetSight
IP …
critical9.8

CVE-2020-11945

An issue was discovered in Squid before 5.0.2.

Impact

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).

Affected products

VendorProductAffected versions
Squid-CacheSquid
from 3.0 through 3.5.28
from 4.0 before 4.11
from 5.0 before 5.0.2
DebianDebian Linux
Versions 9.0, 10.0
OpensuseLeap
Version 15.1
FedoraprojectFedora
Versions 30, 31, 32
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.10, 20.04

Weakness classification

CWE-190

References