CVE-2019-12527 — Out-of-bounds Write in Squid
Severity
8.8HIGHNVD
OSV9.8
EPSS
12.4%
top 6.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 11
Latest updateMay 24
Description
An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages2 packages
Also affects: Debian Linux 10.0, Fedora 29, Ubuntu Linux 16.04, 18.04, 19.04, Enterprise Linux 8.0, 8.1, 8.2, 8.4, 8.6