Affected: AlmaLinux:8: libecap, AlmaLinux:8: libecap-devel

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

* squid: Improper input validation in URI processor (CVE-2019-12523)

* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

* squid: Heap overflow issue in URN processing (CVE-2019-12526)

* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

* squid: Buffer overflow in URI processor (CVE-2019-18676)

* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

* squid: DoS in TLS handshake (…

An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.

An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.

squid: Improper input validation in request allows for proxy manipulation squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash squid: Improper input validation in URI processor squid: Improper access restriction in url_regex may lead to security bypass squid: Heap overflow issue in URN processing squid: Information Disclosure issue in FTP Gateway squid: Out of bounds read in Proxy-Authorization header causes DoS squid: Denial of service in cachemgr.cgi squid: Buffer overflow in URI processor squid: Cross-Site Request Forgery issue in HTTP Request processing squid: HTTP Request Splitting issue in HTTP message processing squid: Information Disclosure issue in HTTP Digest Authentication squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour squid: Improper input validation issues in HTTP Request processing squid: Buffer overflow in reverse-proxy configurations squid: DoS in TLS handshake squid: Request smuggling and poisoning attack against the HTTP cache squid: Improper input validation could result in a DoS

Security update for squid

Affected: Ubuntu:18.04:LTS: squid3

An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Squid ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen oder Sicherheitsvorkehrungen zu umgehen.