Debian Squid vulnerabilities

CVE-2020-15810 [MEDIUM] CVE-2020-15810: squid - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorr... An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary s

CVE-2020-15811 [MEDIUM] CVE-2020-15811: squid - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorr... An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary

CVE-2020-14058 [HIGH] CVE-2020-14058: squid - An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of... An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects th

CVE-2020-8517 [HIGH] CVE-2020-8517: squid - An issue was discovered in Squid before 4.10. Due to incorrect input validation,... An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of

CVE-2020-14059 [MEDIUM] CVE-2020-14059: squid - An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchroni... An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA problem during access to the memory page/slot management list. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2019-12524 [CRITICAL] CVE-2019-12524: squid - An issue was discovered in Squid through 4.7. When handling requests from users,... An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes

CVE-2019-12523 [CRITICAL] CVE-2019-12523: squid - An issue was discovered in Squid before 4.9. When handling a URN request, a corr... An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on lo

CVE-2019-12526 [CRITICAL] CVE-2019-12526: squid - An issue was discovered in Squid before 4.9. URN response handling in Squid suff... An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap. Scope: local bookworm: resolved (fixed in 4.

CVE-2019-12525 [CRITICAL] CVE-2019-12525: squid - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When ... An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid ne

CVE-2019-12519 [CRITICAL] CVE-2019-12519: squid - An issue was discovered in Squid through 4.7. When handling the tag esi:when whe... An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, t

CVE-2019-12854 [HIGH] CVE-2019-12854: squid - Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may acce... Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it. Scope: local bookworm: resolved (fixed in 4.8-1) bullseye: resolved (fixed in 4.8-1) forky: resolved (fixed

CVE-2019-12528 [HIGH] CVE-2019-12528: squid - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to ... An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes. Scope: local bookworm: resolved (fixed in 4.10-1) bullseye: resolved (fixed in 4.10-1) forky: resolved (fixed in 4.10-1) sid: resolved (fixed in 4

CVE-2019-18676 [HIGH] CVE-2019-18676: squid - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input... An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a

CVE-2019-12520 [HIGH] CVE-2019-12520: squid - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Sq... An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended

CVE-2019-18679 [HIGH] CVE-2019-18679: squid - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect... An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to t

CVE-2019-12527 [HIGH] CVE-2019-12527: squid - An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authent... An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data. Scope: local bookworm: resolved (fixed in 4.8-1) bullseye:

CVE-2019-13345 [MEDIUM] CVE-2019-13345: squid - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or au... The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. Scope: local bookworm: resolved (fixed in 4.8-1) bullseye: resolved (fixed in 4.8-1) forky: resolved (fixed in 4.8-1) sid: resolved (fixed in 4.8-1) trixie: resolved (fixed in 4.8-1)

CVE-2019-18678 [MEDIUM] CVE-2019-18678: squid - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to... An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between

CVE-2019-18677 [MEDIUM] CVE-2019-18677: squid - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain ... An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to. Scope: local bookworm: resolved (fixed in 4.9-1) bullseye:

CVE-2019-12521 [MEDIUM] CVE-2019-12521: squid - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keep... An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 e