Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Squid may expose data through WCCP handling
published 4 years ago
Summary
The Squid proxy server packages on AlmaLinux (squid, libecap, libecap-devel) can read beyond the intended memory area when processing WCCP protocol messages, potentially revealing private information. This occurs because the software does not properly check the size of incoming data. Install the latest security update from AlmaLinux as soon as possible to close the gap.
What to do
- Update almalinux libecap to version 1.0.1-2.module_el8.6.0+2741+01592ae8.
- Update almalinux libecap-devel to version 1.0.1-2.module_el8.6.0+2741+01592ae8.
- Update almalinux squid to version 7:4.15-3.module_el8.6.0+2741+01592ae8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | libecap |
< 1.0.1-2.module_el8.6.0+2741+01592ae8 Fix: upgrade to 1.0.1-2.module_el8.6.0+2741+01592ae8
|
| AlmaLinux:8 | almalinux | libecap-devel |
< 1.0.1-2.module_el8.6.0+2741+01592ae8 Fix: upgrade to 1.0.1-2.module_el8.6.0+2741+01592ae8
|
| AlmaLinux:8 | almalinux | squid |
< 7:4.15-3.module_el8.6.0+2741+01592ae8 Fix: upgrade to 7:4.15-3.module_el8.6.0+2741+01592ae8
|
Original advisory text
Moderate: squid:4 security and bug fix update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
Security Fix(es):
* squid: out-of-bounds read in WCCP protocol data may lead to information disclosure (CVE-2021-28116)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Security Fix(es):
* squid: out-of-bounds read in WCCP protocol data may lead to information disclosure (CVE-2021-28116)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
References
- https://access.redhat.com/errata/RHSA-2022:1939 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2021-28116 Third Party Advisory
- https://bugzilla.redhat.com/1939939 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2022-1939.html Vendor Advisory
Timeline
Published10 May 2022
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2022:1939 · OSV
Track software like this
Free during beta