Ubuntu
squid3 package

  1. Bug #1473691
  2. Comment #5

Comment 5 for bug 1473691

Revision history for this message
Seth Arnold (seth-arnold) wrote : Re: squid: Update to latest upstream release (3.5)

e-Vent, we rated this issue "low" because:

- snmp is not enabled by default
- squid's snmp listener can listen on specific interfaces
- local iptables / ufw rules probably already allow only specific services on the hosts that run squid
- network firewalls / routers probably already allow only specific services on the networks that run squid

In general allowing untrusted access to SNMP is not a good idea regardless if this is fixed.

We have limited resources and we have to prioritize the work we do accordingly. If you have the time and inclination to prepare and test a patch for this issue, we'd be happy to sponsor updates. See https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation for more details.

Thanks