UpHeron
All vulnerabilities

Servers and applications

CVE-2022-41317

SQUID-2022:1 Exposure of Sensitive Information in Cache Manager

Severity
Medium 6.5
Published
23 Sept 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.7
Also known as
GHSA-rcg9-7fqm-83mq
Sources
NVD, Project advisories (GitHub)

Description

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.

Affected software

SoftwareAffected versions
SquidServers and applications · cpe:a:squid-cache:squid
  • From 4.9 up to 4.17
  • From 5.0.6 before 5.7
SquidServers and applications · github:squid-cache/squid
  • From 5.0.6 before 5.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-41317
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-41317
  • GitHub Advisory Database https://github.com/advisories/GHSA-rcg9-7fqm-83mq
  • github.com https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq