CVE-2018-1172

Squid is the “traffic guard” that forwards web requests for your network. This bug lets a stranger send a specially made request that can make Squid stop responding or crash, kind of like tripping a circuit breaker so your internet access through the proxy fails.

This matters if your business runs The Squid Software Foundation Squid, and specifically Squid 3.5.27-20180318. The attack does not require authentication or user action, so if an attacker can reach your Squid over the network, they can attempt the crash. It’s mainly a risk when your Squid is reachable from the network path the attacker can use (for many setups, that means internet-reachable or otherwise reachable from untrusted networks) and you’re using the relevant SSL bumping-related behavior that the bug targets.

This is an availability problem that can be triggered remotely without login, so attackers only need network reachability to cause outages. Even without confirmed widespread exploitation in the findings, the impact is service downtime, so you should schedule the upgrade promptly rather than treating it as purely theoretical.

1. Confirm exposure
   • Identify the running Squid version on the affected host(s).
   • If the version matches Squid 3.5.27-20180318, treat the host as vulnerable.
2. Map your configuration to the likely trigger
   • The vulnerability is described as involving sslBumpAccessCheck(), so review whether you use SSL bumping features in your Squid configuration.
   • If SSL bumping is enabled, prioritize those systems first.
3. Upgrade to the vendor-fixed version
   • Use the vendor remediation in SQUID-2018_3 (linked in the findings) to determine the exact fixed Squid release for your branch.
   • Apply the upgrade, then restart Squid.
   • Note any operational changes required by the upgrade path described by the vendor advisory.
4. If you cannot patch immediately (temporary containment)
   • Restrict network access to Squid so it is not reachable from untrusted networks (for example, only allow access from trusted internal IP ranges).
   • If Squid is exposed to the internet, ensure it’s protected by strong network controls (firewalls/WAF/ACLs) that block attacker-supplied requests from reaching the vulnerable code paths.
5. Validate
   • After the upgrade/restart, verify that proxying works normally.
   • If SSL bumping is used, specifically test representative HTTPS flows through the proxy.
6. Monitor
   • Watch for crashes/restarts and related error logs around times of suspicious traffic.
   • Because the issue is a denial-of-service, alert on unexpected process exits or sudden drops in proxy availability.

CVE-2018-1172 is a denial-of-service vulnerability (CWE-476) in The Squid Software Foundation Squid. The findings indicate the bug is reachable over the network without authentication and can be triggered by a crafted request that causes Squid to dereference an invalid/empty memory address (described as a null pointer dereference) in ClientRequestContext::sslBumpAccessCheck(). The outcome is a crash or service stop, impacting availability of the proxy. No KEV listing was provided, and there is no public exploit code on record in the findings. Press attention is noted as rising, but the verdict for this item is AMBER. The findings include a predicted exploitation likelihood value (EPSS), but it should not be treated as confirmation of real-world exploitation.