Alpine: squid: security update to 3.5.27-r4

high Tenable Cloud Security Plugin ID 407226

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of
sensitive information from heap memory, such as information associated with other users' sessions or non-
Squid processes. (CVE-2019-12528)

- An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted
HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
(CVE-2020-8449)

- An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can
cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)

- An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication
credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with
memory access protections, this can result in the helper process being terminated unexpectedly. This leads
to the Squid process also terminating and a denial of service for all clients using the proxy.
(CVE-2020-8517)

Plugin Details

Severity: High

ID: 407226

Version: Revision 1.30

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-8450

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2020-8449

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2/4/2020

Reference Information

CVE: CVE-2019-12528, CVE-2020-8449, CVE-2020-8450, CVE-2020-8517

Detections

Analytics