{"id":110912,"date":"2023-10-18T09:10:25","date_gmt":"2023-10-18T07:10:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda"},"modified":"2023-10-18T09:10:25","modified_gmt":"2023-10-18T07:10:25","slug":"desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","title":{"rendered":"Dozens of vulnerabilities in Squid have remained unaddressed for over 2.5 years.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
More than two years have passed since the discovery of 35 vulnerabilities in the Squid caching proxy, and most of them have still not been fixed, warns the security expert who first reported these issues.<\/p>\n
In February 2021, security specialist Joshua Rogers analyzed Squid and identified 55 vulnerabilities in the project\u2019s code.<\/p>\n
As of now, only 20 of them have been addressed. The majority of vulnerabilities have not received CVE designations, indicating the absence of official fixes or recommendations for remediation. In a letter to the Openwall security community, Rogers stated that after waiting for a long time, he decided to publish this information.<\/p>\n
Rogers detailed the vulnerabilities on his website, highlighting the variety of issues \u2014 use-after-free, memory leak, cache poisoning, assertion failure, and other flaws across various components. At the same time, the specialist expressed understanding for the Squid team, noting that many developers of open-source projects work on a voluntary basis and may not always be able to respond quickly to such problems.<\/p>\n
It is worth noting that Squid is currently used in millions of instances worldwide.<\/p>\n
Rogers' recommendations imply that each user must assess whether Squid is suitable for their system. Otherwise, users may face failures and risks in the field of information security.<\/p>\n
This situation reminds us all of the importance of regularly updating and securing software. Otherwise, as Rogers emphasizes, \"there will be no point to it.\"<\/p>\n
This troubling episode raises serious questions about the security of open projects and their ability to handle the ongoing stream of new vulnerabilities.<\/p>\n
We can only hope that community members and developers will take urgent action to address this threat in the future.<\/p>\n