NVT Update

Vulnerability Tests
6

There haven’t been changed much since back then:

As seen on Squid Caching Proxy Security Audit: 55 vulnerabilities and 35 0days | Squid-Security-Audit there is still quite a huge amount (24 in total) of unfixed vulnerabilities / existing vulnerabilities not fixed in a final release in Squid (namely all which are listed on that page without a CVE assigned / listed on that overview). Those should also (mostly) match the ones which are only listed as having only mitigations available on Unofficial status of "Joshua 55" vulnerabilities in Squid · GitHub

As of today the reporting of the VT in question is still correct and there is no need for any updates / score updates so far.

If you disagree with the current assessment / scoring you can create an override on your own risk accordingly.

Note: Once there are new advisories from Squid project side available for sure the VT will be updated to remove that now fixed vulnerability/vulnerabilities from the description of the VT in question. Such fixed flaws will then be handled in a dedicated VT like happened in the past (see e.g. all more recent VTs having a reference to https://megamansec.github.io/Squid-Security-Audit/).

The situation is also constantly monitored from our side and newly published updates are getting reported to the original security researcher like done here for example:

2 Likes