Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.squid-cache.org/Advisories/SQUID-2016_11.txt | x_refsource_CONFIRM |
| http://www.securitytracker.com/id/1037513 | vdb-entry x_refsource_SECTRACK |
| http://www.openwall.com/lists/oss-security/2016/12/18/1 | mailing-list x_refsource_MLIST |
| http://rhn.redhat.com/errata/RHSA-2017-0183.html | vendor-advisory x_refsource_REDHAT |
| http://rhn.redhat.com/errata/RHSA-2017-0182.html | vendor-advisory x_refsource_REDHAT |
| http://www.securityfocus.com/bid/94953 | vdb-entry x_refsource_BID |
| http://www.debian.org/security/2016/dsa-3745 | vendor-advisory x_refsource_DEBIAN |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.squid-cache.org/Advisories/SQUID-2016_11.txt | x_refsource_CONFIRM x_transferred |
| http://www.securitytracker.com/id/1037513 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://www.openwall.com/lists/oss-security/2016/12/18/1 | mailing-list x_refsource_MLIST x_transferred |
| http://rhn.redhat.com/errata/RHSA-2017-0183.html | vendor-advisory x_refsource_REDHAT x_transferred |
| http://rhn.redhat.com/errata/RHSA-2017-0182.html | vendor-advisory x_refsource_REDHAT x_transferred |
| http://www.securityfocus.com/bid/94953 | vdb-entry x_refsource_BID x_transferred |
| http://www.debian.org/security/2016/dsa-3745 | vendor-advisory x_refsource_DEBIAN x_transferred |
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 7.5 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Primary | 2.0 | 5.0 | MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| Hyperlink | Source | Resource |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2017-0182.html | cve@mitre.org | N/A |
| http://rhn.redhat.com/errata/RHSA-2017-0183.html | cve@mitre.org | N/A |
| http://www.debian.org/security/2016/dsa-3745 | cve@mitre.org | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/12/18/1 | cve@mitre.org | Mailing List Patch Third Party Advisory |
| http://www.securityfocus.com/bid/94953 | cve@mitre.org | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1037513 | cve@mitre.org | Third Party Advisory VDB Entry |
| http://www.squid-cache.org/Advisories/SQUID-2016_11.txt | cve@mitre.org | Mitigation Patch Vendor Advisory |
| http://rhn.redhat.com/errata/RHSA-2017-0182.html | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://rhn.redhat.com/errata/RHSA-2017-0183.html | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://www.debian.org/security/2016/dsa-3745 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/12/18/1 | af854a3a-2127-422b-91ae-364da2661108 | Mailing List Patch Third Party Advisory |
| http://www.securityfocus.com/bid/94953 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1037513 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |
| http://www.squid-cache.org/Advisories/SQUID-2016_11.txt | af854a3a-2127-422b-91ae-364da2661108 | Mitigation Patch Vendor Advisory |