{
  "threat_severity" : "Moderate",
  "public_date" : "2022-09-23T00:00:00Z",
  "bugzilla" : {
    "description" : "squid: exposure of sensitive information in cache manager",
    "id" : "2129770",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2129770"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
    "status" : "draft"
  },
  "cwe" : "CWE-284->CWE-200",
  "details" : [ "An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.", "A flaw was found in squid. A trusted client can directly access the cache manager information, bypassing the manager ACL protection and resulting in information disclosure." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "squid34",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Will not fix",
    "package_name" : "squid:4/squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Will not fix",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2022-41317\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-41317\nhttps://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq" ],
  "name" : "CVE-2022-41317",
  "mitigation" : {
    "value" : "Adding the following line to the squid.conf file is a workaround:\nacl manager url_regex +i ^[^:]+://[^/]+/squid-internal-mgr/",
    "lang" : "en:us"
  },
  "csaw" : false
}