Security Alert: Squid Proxy’s Unresolved Vulnerabilities

Over two years have elapsed since the discovery of 35 vulnerabilities in the Squid caching proxy, yet they remain unaddressed, warns the security specialist who first spotlighted these issues.

Squid is a web proxy extensively employed by internet service providers and website proprietors. In February 2021, security expert Joshua Rogers undertook an analysis of Squid, discerning 55 vulnerabilities within the project’s code.

To date, a mere 20 of these have been rectified. A significant proportion of these vulnerabilities haven’t been assigned CVE identifiers, signifying the lack of official patches or mitigation recommendations. In a communiqué to the Openwall security community, Rogers conveyed that after an extended period of anticipation, he decided to disseminate this information.

Rogers elucidated these vulnerabilities on his personal website, emphasizing the gamut of issues – Use-After-Free, memory leaks, cache poisoning, assertion failures, and various other deficiencies spanning disparate components. Concurrently, he expressed empathy towards the Squid team, acknowledging that numerous open-source project developers volunteer their expertise and may not always promptly respond to such predicaments.

The incident raises contemplations regarding who should bear the responsibility for sustaining open-source software. Given that over 2.5 million servers operate on Squid’s foundation across the web, Rogers advises all patrons of this product to scrupulously appraise the vulnerability details and, if deemed necessary, to reconsider in favor of alternative solutions.