Home > Vulnerability Database > CVE-2023-46847

Mend.io Vulnerability Database

CVE-2023-46847

Good to know:

Date: November 3, 2023

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

Language: C++

Severity Score

7.5

Related Resources (23)

Url: https://access.redhat.com/errata/RHSA-2023:6748

Url: https://access.redhat.com/errata/RHSA-2023:6803

Url: https://access.redhat.com/errata/RHSA-2023:6804

Url: https://access.redhat.com/errata/RHSA-2023:6801

Url: https://access.redhat.com/errata/RHSA-2023:6810

Url: https://bugzilla.redhat.com/show_bug.cgi?id=2245916

Url: https://access.redhat.com/errata/RHSA-2023:7578

Url: https://security-tracker.debian.org/tracker/CVE-2023-46847

Url: https://security.netapp.com/advisory/ntap-20231130-0002/

Url: https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g

Url: https://access.redhat.com/errata/RHSA-2023:6805

Url: https://github.com/squid-cache/squid/commit/dc0e10bec3334053c1a5297e50dd7052ea18aef0

Url: https://access.redhat.com/errata/RHSA-2023:6267

Url: https://access.redhat.com/errata/RHSA-2023:7213

Url: https://access.redhat.com/errata/RHSA-2023:7576

Url: https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html

Url: https://access.redhat.com/errata/RHSA-2023:6268

Url: https://access.redhat.com/errata/RHSA-2023:6884

Url: https://access.redhat.com/errata/RHSA-2023:6266

Url: https://access.redhat.com/errata/RHSA-2023:6882

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-46847

Url: https://access.redhat.com/security/cve/CVE-2023-46847

Url: https://www.mend.io/vulnerability-database/CVE-2023-46847

Severity Score

7.5

Weakness Type (CWE)

Uncontrolled Resource Consumption ('Resource Exhaustion')

CWE-400

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-120

Heap-based Buffer Overflow

CWE-122

Top Fix

Upgrade Version

Upgrade to version SQUID_6_4

Learn More

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2023-46847

Good to know:

Date: November 3, 2023

Language: C++

Severity Score

Related Resources (23)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?