Amazon Linux 2 Security Advisory: ALASSQUID4-2023-005
Advisory Release Date: 2023-08-21 20:59 Pacific
Advisory Updated Date: 2023-09-25 22:00 Pacific
A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling. This issue could allow a trusted client to perform an HTTP request smuggling attack and access services otherwise forbidden by squid. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-25097)
Affected Packages:
squid
Note:
This advisory is applicable to Amazon Linux 2 - Squid4 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update squid to update your system.
aarch64:
squid-4.14-1.amzn2.0.1.aarch64
squid-debuginfo-4.14-1.amzn2.0.1.aarch64
i686:
squid-4.14-1.amzn2.0.1.i686
squid-debuginfo-4.14-1.amzn2.0.1.i686
src:
squid-4.14-1.amzn2.0.1.src
x86_64:
squid-4.14-1.amzn2.0.1.x86_64
squid-debuginfo-4.14-1.amzn2.0.1.x86_64