CVE-2020-14058
Fixed in a distro release EPSS 3%
An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.
Products: squid-cache squid, fedoraproject fedora, netapp cloud_manager
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | libecap | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| AlmaLinux 8 | libecap-devel | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| Amazon Linux 2 | squid | 7:3.5.20-17.amzn2.7.3 |
| Amazon Linux 2 | squid-migration-script | 7:3.5.20-17.amzn2.7.3 |
| Amazon Linux 2 | squid-sysvinit | 7:3.5.20-17.amzn2.7.3 |
| Debian 12 | squid | 4.12-1 |
| Debian 13 | squid | 4.12-1 |
| Debian 14 | squid | 4.12-1 |
| Red Hat Enterprise Linux 8 | libecap | 0:1.0.1-2.module+el8.1.0+4044+36416a77 |
| Red Hat Enterprise Linux 8 | libecap-debuginfo | 0:1.0.1-2.module+el8.1.0+4044+36416a77 |
| Red Hat Enterprise Linux 8 | libecap-debugsource | 0:1.0.1-2.module+el8.1.0+4044+36416a77 |
| Red Hat Enterprise Linux 8 | libecap-devel | 0:1.0.1-2.module+el8.1.0+4044+36416a77 |
| Red Hat Enterprise Linux 8 | squid | 7:4.11-3.module+el8.3.0+7851+7808b5f9 |
| Red Hat Enterprise Linux 8 | squid-debuginfo | 7:4.11-3.module+el8.3.0+7851+7808b5f9 |
| Red Hat Enterprise Linux 8 | squid-debugsource | 7:4.11-3.module+el8.3.0+7851+7808b5f9 |
| Rocky Linux 8 | libecap | 0:1.0.1-2.module+el8.4.0+404+316a0dc5 |