CVE-2016-2390

The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with…

published April 19, 2016

CVSS

—

EPSS

26%

Percentile

97.9

In the wild

Unconfirmed

What it is

The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.25550 · 97.9th percentile
Published: 2016-04-19T21:00Z

EPSS history

Timeline

19 APR 21:00Z
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with…
cvelistv5