An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-06-30T18:30:56

Updated: 2024-08-04T12:32:14.692Z

Reserved: 2020-06-13T00:00:00

Link: CVE-2020-14058

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-06-30T19:15:11.130

Modified: 2024-11-21T05:02:27.447

Link: CVE-2020-14058

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-06-19T00:00:00Z

Links: CVE-2020-14058 - Bugzilla