{"id":"CVE-2016-10002","details":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","modified":"2026-07-07T08:45:32.606855053Z","published":"2017-01-27T17:59:00.133Z","related":["SUSE-SU-2017:0110-1","SUSE-SU-2017:0116-1","SUSE-SU-2017:0128-1","openSUSE-SU-2024:11403-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"source":"CPE_STRING","vendor_product":"squid-cache:squid","cpes":["cpe:2.3:a:squid-cache:squid:3.4.0.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.4.0.4"},{"last_affected":"3.4.0.4"}]}]},"references":[{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0182.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0183.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3745"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/94953"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1037513"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2016/12/18/1"},{"type":"FIX","url":"http://www.squid-cache.org/Advisories/SQUID-2016_11.txt"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/squid-cache/squid","events":[{"introduced":"af550ae944efbe50221fa9080d0eb17b724a743e"},{"last_affected":"6276f56c96d7b68a43c5e568faaaa428fe108c20"}],"database_specific":{"cpe":["cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.15:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.16:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.17:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.18:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.19:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.20:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.21:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.22:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.1.23:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.11:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.12:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.13:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.14:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.16:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.17:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.0.19:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.4:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.6:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.7:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.8:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.9:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.10:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.11:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.12:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.13:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.2.14:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.0.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.0.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.6:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.7:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.8:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.9:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.10:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.11:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.12:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.13:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.3.14:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.0.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.0.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.4:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.6:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.7:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.8:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.9:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.10:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.11:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.12:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.13:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.4.14:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.4:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.6:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.7:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.8:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.9:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.10:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.11:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.13:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.14:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.15:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.16:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.17:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.18:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.19:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.20:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.21:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:3.5.22:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.4:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.6:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.7:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.8:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.9:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.10:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.11:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.12:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.13:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.14:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.15:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.16:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.1.10"},{"last_affected":"3.1.10"},{"introduced":"3.1.11"},{"last_affected":"3.1.11"},{"introduced":"3.1.12"},{"last_affected":"3.1.12"},{"introduced":"3.1.14"},{"last_affected":"3.1.14"},{"introduced":"3.1.15"},{"last_affected":"3.1.15"},{"introduced":"3.1.16"},{"last_affected":"3.1.16"},{"introduced":"3.1.17"},{"last_affected":"3.1.17"},{"introduced":"3.1.18"},{"last_affected":"3.1.18"},{"introduced":"3.1.19"},{"last_affected":"3.1.19"},{"introduced":"3.1.20"},{"last_affected":"3.1.20"},{"introduced":"3.1.21"},{"last_affected":"3.1.21"},{"introduced":"3.1.22"},{"last_affected":"3.1.22"},{"introduced":"3.1.23"},{"last_affected":"3.1.23"},{"introduced":"3.2.0.3"},{"last_affected":"3.2.0.3"},{"introduced":"3.2.0.4"},{"last_affected":"3.2.0.4"},{"introduced":"3.2.0.5"},{"last_affected":"3.2.0.5"},{"introduced":"3.2.0.6"},{"last_affected":"3.2.0.6"},{"introduced":"3.2.0.7"},{"last_affected":"3.2.0.7"},{"introduced":"3.2.0.8"},{"last_affected":"3.2.0.8"},{"introduced":"3.2.0.9"},{"last_affected":"3.2.0.9"},{"introduced":"3.2.0.10"},{"last_affected":"3.2.0.10"},{"introduced":"3.2.0.11"},{"last_affected":"3.2.0.11"},{"introduced":"3.2.0.12"},{"last_affected":"3.2.0.12"},{"introduced":"3.2.0.13"},{"last_affected":"3.2.0.13"},{"introduced":"3.2.0.14"},{"last_affected":"3.2.0.14"},{"introduced":"3.2.0.15"},{"last_affected":"3.2.0.15"},{"introduced":"3.2.0.16"},{"last_affected":"3.2.0.16"},{"introduced":"3.2.0.17"},{"last_affected":"3.2.0.17"},{"introduced":"3.2.0.18"},{"last_affected":"3.2.0.18"},{"introduced":"3.2.0.19"},{"last_affected":"3.2.0.19"},{"introduced":"3.2.1"},{"last_affected":"3.2.1"},{"introduced":"3.2.2"},{"last_affected":"3.2.2"},{"introduced":"3.2.3"},{"last_affected":"3.2.3"},{"introduced":"3.2.4"},{"last_affected":"3.2.4"},{"introduced":"3.2.5"},{"last_affected":"3.2.5"},{"introduced":"3.2.6"},{"last_affected":"3.2.6"},{"introduced":"3.2.7"},{"last_affected":"3.2.7"},{"introduced":"3.2.8"},{"last_affected":"3.2.8"},{"introduced":"3.2.9"},{"last_affected":"3.2.9"},{"introduced":"3.2.10"},{"last_affected":"3.2.10"},{"introduced":"3.2.11"},{"last_affected":"3.2.11"},{"introduced":"3.2.12"},{"last_affected":"3.2.12"},{"introduced":"3.2.13"},{"last_affected":"3.2.13"},{"introduced":"3.2.14"},{"last_affected":"3.2.14"},{"introduced":"3.3.0.1"},{"last_affected":"3.3.0.1"},{"introduced":"3.3.0.2"},{"last_affected":"3.3.0.2"},{"introduced":"3.3.0.3"},{"last_affected":"3.3.0.3"},{"introduced":"3.3.1"},{"last_affected":"3.3.1"},{"introduced":"3.3.2"},{"last_affected":"3.3.2"},{"introduced":"3.3.3"},{"last_affected":"3.3.3"},{"introduced":"3.3.4"},{"last_affected":"3.3.4"},{"introduced":"3.3.5"},{"last_affected":"3.3.5"},{"introduced":"3.3.6"},{"last_affected":"3.3.6"},{"introduced":"3.3.7"},{"last_affected":"3.3.7"},{"introduced":"3.3.8"},{"last_affected":"3.3.8"},{"introduced":"3.3.9"},{"last_affected":"3.3.9"},{"introduced":"3.3.10"},{"last_affected":"3.3.10"},{"introduced":"3.3.11"},{"last_affected":"3.3.11"},{"introduced":"3.3.12"},{"last_affected":"3.3.12"},{"introduced":"3.3.13"},{"last_affected":"3.3.13"},{"introduced":"3.3.14"},{"last_affected":"3.3.14"},{"introduced":"3.4.0.1"},{"last_affected":"3.4.0.1"},{"introduced":"3.4.0.2"},{"last_affected":"3.4.0.2"},{"introduced":"3.4.0.3"},{"last_affected":"3.4.0.3"},{"introduced":"3.4.1"},{"last_affected":"3.4.1"},{"introduced":"3.4.2"},{"last_affected":"3.4.2"},{"introduced":"3.4.3"},{"last_affected":"3.4.3"},{"introduced":"3.4.4"},{"last_affected":"3.4.4"},{"introduced":"3.4.5"},{"last_affected":"3.4.5"},{"introduced":"3.4.6"},{"last_affected":"3.4.6"},{"introduced":"3.4.7"},{"last_affected":"3.4.7"},{"introduced":"3.4.8"},{"last_affected":"3.4.8"},{"introduced":"3.4.9"},{"last_affected":"3.4.9"},{"introduced":"3.4.10"},{"last_affected":"3.4.10"},{"introduced":"3.4.11"},{"last_affected":"3.4.11"},{"introduced":"3.4.12"},{"last_affected":"3.4.12"},{"introduced":"3.4.13"},{"last_affected":"3.4.13"},{"introduced":"3.4.14"},{"last_affected":"3.4.14"},{"introduced":"3.5.0.1"},{"last_affected":"3.5.0.1"},{"introduced":"3.5.0.2"},{"last_affected":"3.5.0.2"},{"introduced":"3.5.0.3"},{"last_affected":"3.5.0.3"},{"introduced":"3.5.0.4"},{"last_affected":"3.5.0.4"},{"introduced":"3.5.1"},{"last_affected":"3.5.1"},{"introduced":"3.5.2"},{"last_affected":"3.5.2"},{"introduced":"3.5.3"},{"last_affected":"3.5.3"},{"introduced":"3.5.4"},{"last_affected":"3.5.4"},{"introduced":"3.5.5"},{"last_affected":"3.5.5"},{"introduced":"3.5.6"},{"last_affected":"3.5.6"},{"introduced":"3.5.7"},{"last_affected":"3.5.7"},{"introduced":"3.5.8"},{"last_affected":"3.5.8"},{"introduced":"3.5.9"},{"last_affected":"3.5.9"},{"introduced":"3.5.10"},{"last_affected":"3.5.10"},{"introduced":"3.5.11"},{"last_affected":"3.5.11"},{"introduced":"3.5.12"},{"last_affected":"3.5.12"},{"introduced":"3.5.13"},{"last_affected":"3.5.13"},{"introduced":"3.5.14"},{"last_affected":"3.5.14"},{"introduced":"3.5.15"},{"last_affected":"3.5.15"},{"introduced":"3.5.16"},{"last_affected":"3.5.16"},{"introduced":"3.5.17"},{"last_affected":"3.5.17"},{"introduced":"3.5.18"},{"last_affected":"3.5.18"},{"introduced":"3.5.19"},{"last_affected":"3.5.19"},{"introduced":"3.5.20"},{"last_affected":"3.5.20"},{"introduced":"3.5.21"},{"last_affected":"3.5.21"},{"introduced":"3.5.22"},{"last_affected":"3.5.22"},{"introduced":"4.0.1"},{"last_affected":"4.0.1"},{"introduced":"4.0.2"},{"last_affected":"4.0.2"},{"introduced":"4.0.3"},{"last_affected":"4.0.3"},{"introduced":"4.0.4"},{"last_affected":"4.0.4"},{"introduced":"4.0.5"},{"last_affected":"4.0.5"},{"introduced":"4.0.6"},{"last_affected":"4.0.6"},{"introduced":"4.0.7"},{"last_affected":"4.0.7"},{"introduced":"4.0.8"},{"last_affected":"4.0.8"},{"introduced":"4.0.9"},{"last_affected":"4.0.9"},{"introduced":"4.0.10"},{"last_affected":"4.0.10"},{"introduced":"4.0.11"},{"last_affected":"4.0.11"},{"introduced":"4.0.12"},{"last_affected":"4.0.12"},{"introduced":"4.0.13"},{"last_affected":"4.0.13"},{"introduced":"4.0.14"},{"last_affected":"4.0.14"},{"introduced":"4.0.15"},{"last_affected":"4.0.15"},{"introduced":"4.0.16"},{"last_affected":"4.0.16"}],"source":"CPE_STRING"}}],"versions":["3.1.10","3.1.11","3.1.12","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.20","3.1.21","3.1.22","3.1.23","3.2.0.10","3.2.0.11","3.2.0.12","3.2.0.13","3.2.0.14","3.2.0.15","3.2.0.16","3.2.0.17","3.2.0.18","3.2.0.19","3.2.0.3","3.2.0.4","3.2.0.5","3.2.0.6","3.2.0.7","3.2.0.8","3.2.0.9","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0.1","3.3.0.2","3.3.0.3","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.14","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0.1","3.4.0.2","3.4.0.3","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.14","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0.1","3.5.0.2","3.5.0.3","3.5.0.4","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.14","3.5.15","3.5.16","3.5.17","3.5.18","3.5.19","3.5.2","3.5.20","3.5.21","3.5.22","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-10002.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}