CVE-2022-41317

Published: Dec 25, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.

Affected (2)

Products: Squid Cache: Squid

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Squid Cache Squid	From 4.9 to 4.17
Squid Cache Squid	From 5.0.6 to 5.7

Related CWEs

Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

References (8)

http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch

Source: cve@mitre.org

PatchVendor Advisory

http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patch

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq

Source: cve@mitre.org

MitigationPatchThird Party Advisory

https://www.openwall.com/lists/oss-security/2022/09/23/1

Source: cve@mitre.org

Mailing ListMitigationPatchThird Party Advisory

http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patch

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationPatchThird Party Advisory

https://www.openwall.com/lists/oss-security/2022/09/23/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListMitigationPatchThird Party Advisory

Timeline

No history available yet.