Most recent entries from all

ALSA-2020:4743 — Moderate: squid:4 security, bug fix, and enhancement update

Affected: AlmaLinux:8: libecap, AlmaLinux:8: libecap-devel

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

* squid: Improper input validation in URI processor (CVE-2019-12523)

* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

* squid: Heap overflow issue in URN processing (CVE-2019-12526)

* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

* squid: Buffer overflow in URI processor (CVE-2019-18676)

* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

* squid: DoS in TLS handshake (…

cnvd-2020-51754

EUVD-2026-42196

fkie_cve-2020-14058

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

gsd-2020-14058

OESA-2021-1092 — squid security update

Affected: openEuler:20.03-LTS-SP1: squid

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fix(es): An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.(CVE-2020-14058) An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810) An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation…

RHSA-2020:4743 — Red Hat Security Advisory: squid:4 security, bug fix, and enhancement update

squid: Improper input validation in request allows for proxy manipulation squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash squid: Improper input validation in URI processor squid: Improper access restriction in url_regex may lead to security bypass squid: Heap overflow issue in URN processing squid: Information Disclosure issue in FTP Gateway squid: Out of bounds read in Proxy-Authorization header causes DoS squid: Denial of service in cachemgr.cgi squid: Buffer overflow in URI processor squid: Cross-Site Request Forgery issue in HTTP Request processing squid: HTTP Request Splitting issue in HTTP message processing squid: Information Disclosure issue in HTTP Digest Authentication squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour squid: Improper input validation issues in HTTP Request processing squid: Buffer overflow in reverse-proxy configurations squid: DoS in TLS handshake squid: Request smuggling and poisoning attack against the HTTP cache squid: Improper input validation could result in a DoS

WID-SEC-W-2023-1360 — Squid: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Squid ausnutzen, um einen Denial of Service Angriff durchzuführen.