CVE record · CVE-2023-46847

Squid: denial of service in http digest authentication

CVSS 8.6 HighCriticalEPSS 0.79 · 99th percentile

Critical, because:

CVSS score 8.6 (7.0 or more) and EPSS 0.79 (0.1 or more): a high score and a real chance of exploitation in the next 30 days.

Published by the CVE Program (CNA: redhat) at 3 Nov 2023, 07:58 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Not given	Not given Package name: squid https://github.com/squid-cache/squid	affected 3.2.0.1 to before 6.4 custom Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support Package name: squid34 https://access.redhat.com/downloads/content/package-browser/	unaffected 7:3.4.14-15.el6_10.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:3.1.23-24.el6_10.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7 Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:3.5.20-17.el7_9.9 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7.6 Advanced Update Support Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:3.5.20-12.el7_6.2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7.7 Advanced Update Support Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:3.5.20-13.el7_7.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020231030214932.63b34585 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8090020231030224841.a75119d5 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8010020231101141358.c27ad7f8 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231101135052.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231101135052.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231101135052.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231101101624.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231101101624.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231101101624.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020231031165747.ad008a3a to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:5.5-5.el9_2.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:5.5-6.el9_3.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:5.2-1.el9_0.3 to before * rpm Other versions: affected

Identifiers: CVE-2023-46847
CNA: redhat
Weakness (CWE): CWE-120
Tags: Red Hat Enterprise Linux 6 Extended Lifecycle Support
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 7.6 Advanced Update Support
Red Hat Enterprise Linux 7.7 Advanced Update Support
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.2 Telecommunications Update Service
Memory corruption
Published: 3 Nov 2023
Updated: 7 Aug 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.6	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H	CNA (redhat)

CISA KEV Not listed.
EPSS 0.79, the 99th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 3 Nov 2023. New records show when each source confirmed them.

Sources

References from the CNA

access.redhat.com/errata/RHSA-2023:6266 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6267 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6268 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6748 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6801 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6803 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6804 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6805 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6810 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6882 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6884 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7213 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7576 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7578 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2023-46847 vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi?id=2245916 issue-trackingredhat
github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.