alsa-2020:4743
Vulnerability from osv_almalinux
Published
2020-11-03 12:32
Modified
2020-11-03 19:54
Summary
Moderate: squid:4 security, bug fix, and enhancement update
Details

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

  • squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

  • squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

  • squid: Improper input validation in URI processor (CVE-2019-12523)

  • squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

  • squid: Heap overflow issue in URN processing (CVE-2019-12526)

  • squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

  • squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

  • squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

  • squid: Buffer overflow in URI processor (CVE-2019-18676)

  • squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

  • squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

  • squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

  • squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

  • squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

  • squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  • squid: DoS in TLS handshake (CVE-2020-14058)

  • squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

  • squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libecap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1-2.module_el8.6.0+2741+01592ae8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libecap-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1-2.module_el8.6.0+2741+01592ae8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nThe following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)\n\nSecurity Fix(es):\n\n* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n* squid: Improper input validation in URI processor (CVE-2019-12523)\n\n* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n* squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n* squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\n* squid: DoS in TLS handshake (CVE-2020-14058)\n\n* squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n* squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.",
  "id": "ALSA-2020:4743",
  "modified": "2020-11-03T19:54:15Z",
  "published": "2020-11-03T12:32:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2020-4743.html"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12520"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12521"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12523"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12524"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12526"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12528"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12529"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12854"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18676"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18677"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18678"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18679"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18860"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14058"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-15049"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-24606"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-8449"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-8450"
    }
  ],
  "related": [
    "CVE-2019-12520",
    "CVE-2019-12521",
    "CVE-2019-12523",
    "CVE-2019-12524",
    "CVE-2019-12526",
    "CVE-2019-12528",
    "CVE-2019-12529",
    "CVE-2019-12854",
    "CVE-2019-18676",
    "CVE-2019-18677",
    "CVE-2019-18678",
    "CVE-2019-18679",
    "CVE-2019-18860",
    "CVE-2020-8449",
    "CVE-2020-8450",
    "CVE-2020-14058",
    "CVE-2020-15049",
    "CVE-2020-24606"
  ],
  "summary": "Moderate: squid:4 security, bug fix, and enhancement update"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.