GNU bug report logs - #47142
squid package vulnerable to CVE-2021-28116

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Mark H Weaver <mhw <at> netris.org>
Subject: bug#47142: closed (Re: bug#47142: squid package vulnerable to
 CVE-2021-28116)
Date: Wed, 23 Mar 2022 03:07:03 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#47142: squid package vulnerable to CVE-2021-28116

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 47142 <at> debbugs.gnu.org.

-- 
47142: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47142
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: Mark H Weaver <mhw <at> netris.org>
Cc: Léo Le Bouter <lle-bout <at> zaclys.net>,
 47142-done <at> debbugs.gnu.org
Subject: Re: bug#47142: squid package vulnerable to CVE-2021-28116
Date: Tue, 22 Mar 2022 23:05:54 -0400

Hello,

Mark H Weaver <mhw <at> netris.org> writes:

> I'm forwarding this to bug-guix <at> gnu.org so that it won't be forgotten.
>
>       Mark
>
> -------------------- Start of forwarded message --------------------
> Subject: squid package vulnerable to CVE-2021-28116
> From: Léo Le Bouter <lle-bout <at> zaclys.net>
> To: guix-devel <at> gnu.org
> Date: Wed, 10 Mar 2021 01:22:51 +0100
>
> CVE-2021-28116	09.03.21 23:15
> Squid through 4.14 and 5.x through 5.0.5, in some configurations,

We're now using squid 4.17.

Closing.

Thanks,

Maxim

[Message part 3 (message/rfc822, inline)]

From: Mark H Weaver <mhw <at> netris.org>
To: bug-guix <at> gnu.org
Cc: Léo Le Bouter <lle-bout <at> zaclys.net>
Subject: squid package vulnerable to CVE-2021-28116
Date: Sun, 14 Mar 2021 17:34:38 -0400

[Message part 4 (text/plain, inline)]

I'm forwarding this to bug-guix <at> gnu.org so that it won't be forgotten.

      Mark

-------------------- Start of forwarded message --------------------
Subject: squid package vulnerable to CVE-2021-28116
From: Léo Le Bouter <lle-bout <at> zaclys.net>
To: guix-devel <at> gnu.org
Date: Wed, 10 Mar 2021 01:22:51 +0100

[Message part 5 (text/plain, inline)]

CVE-2021-28116	09.03.21 23:15
Squid through 4.14 and 5.x through 5.0.5, in some configurations,
allows information disclosure because of an out-of-bounds read in WCCP
protocol data. This can be leveraged as part of a chain for remote code
execution as nobody.

Upstream did not release a patch yet. CVE entry to be monitored for a
fix.

https://www.zerodayinitiative.com/advisories/ZDI-21-157/ - says it is a
low impact issue.

[signature.asc (application/pgp-signature, inline)]

[Message part 7 (text/plain, inline)]

-------------------- End of forwarded message --------------------

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.