Vulnerability-Lookup

CVE-2020-14058 (GCVE-0-2020-14058)

Vulnerability from cvelistv5 – Published: 2020-06-30 18:30 – Updated: 2024-08-04 12:32

Summary

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Assigner

mitre mitre root

References

5 references

URL	Tags
http://www.squid-cache.org/Versions/v5/changesets…	x_refsource_MISC
http://www.squid-cache.org/Versions/v4/changesets…	x_refsource_MISC
http://www.squid-cache.org/Advisories/SQUID-2020_6.txt	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.netapp.com/advisory/ntap-2021031…	x_refsource_CONFIRM

Date Public

2020-06-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.692Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
          },
          {
            "name": "FEDORA-2020-cbebc5617e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2020-06-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-12T12:06:31.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
        },
        {
          "name": "FEDORA-2020-cbebc5617e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-14058",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch",
              "refsource": "MISC",
              "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
            },
            {
              "name": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch",
              "refsource": "MISC",
              "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
            },
            {
              "name": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt",
              "refsource": "CONFIRM",
              "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
            },
            {
              "name": "FEDORA-2020-cbebc5617e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210312-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-14058",
    "datePublished": "2020-06-30T18:30:56.000Z",
    "dateReserved": "2020-06-13T00:00:00.000Z",
    "dateUpdated": "2024-08-04T12:32:14.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-14058",
      "date": "2026-09-28",
      "epss": "0.02538",
      "percentile": "0.84347"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E3828B8E-1FF7-4707-BB24-6C7CABC37362",
                  "versionEndIncluding": "3.5.28",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C3430B4A-4E1E-438D-9C84-4CFED6A3F023",
                  "versionEndExcluding": "4.12",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "137B599B-80D1-4903-8791-40F11BC3FCD9",
                  "versionEndExcluding": "5.0.3",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                  "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "197D0D80-6702-4B61-B681-AFDBA7D69067",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string."
        },
        {
          "lang": "es",
          "value": "Se detect\u00f3 un problema en Squid versiones anteriores a 4.12 y versiones 5.x anteriores a  5.0.3. Debido al uso de una funci\u00f3n potencialmente peligrosa, Squid y el asistente de comprobaci\u00f3n de certificados predeterminado son vulnerables a una Denegaci\u00f3n de Servicio al abrir una conexi\u00f3n TLS en un servidor controlado por el atacante por HTTPS. Esto ocurre porque los valores de error no reconocidos son asignados a NULL, pero el c\u00f3digo posterior espera que cada valor de error sea asignado a una cadena de error v\u00e1lida"
        }
      ],
      "id": "CVE-2020-14058",
      "lastModified": "2024-11-21T05:02:27.447",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 5.0,
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2020-06-30T19:15:11.130",
      "references": [
        {
          "source": "cve@mitre.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
        },
        {
          "source": "cve@mitre.org",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E3828B8E-1FF7-4707-BB24-6C7CABC37362",
                    "versionEndIncluding": "3.5.28",
                    "versionStartIncluding": "3.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C3430B4A-4E1E-438D-9C84-4CFED6A3F023",
                    "versionEndExcluding": "4.12",
                    "versionStartIncluding": "4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "137B599B-80D1-4903-8791-40F11BC3FCD9",
                    "versionEndExcluding": "5.0.3",
                    "versionStartIncluding": "5.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "197D0D80-6702-4B61-B681-AFDBA7D69067",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string."
          },
          {
            "lang": "es",
            "value": "Se detect\u00f3 un problema en Squid versiones anteriores a 4.12 y versiones 5.x anteriores a  5.0.3. Debido al uso de una funci\u00f3n potencialmente peligrosa, Squid y el asistente de comprobaci\u00f3n de certificados predeterminado son vulnerables a una Denegaci\u00f3n de Servicio al abrir una conexi\u00f3n TLS en un servidor controlado por el atacante por HTTPS. Esto ocurre porque los valores de error no reconocidos son asignados a NULL, pero el c\u00f3digo posterior espera que cada valor de error sea asignado a una cadena de error v\u00e1lida"
          }
        ],
        "id": "CVE-2020-14058",
        "lastModified": "2024-11-21T05:02:27.447",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 5.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-06-30T19:15:11.130",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T16:18:50+00:00",
      "cve": "CVE-2020-14058",
      "id": "CVE-2020-14058",
      "initial_release_date": "2020-06-19T00:00:00+00:00",
      "product_status:fixed": "30",
      "product_status:known_affected": "8",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "squid: DoS in TLS handshake",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-14058.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T23:59:30Z",
      "cve": "CVE-2020-14058",
      "id": "CVE-2020-14058",
      "initial_release_date": "2023-02-15T03:58:03Z",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "3",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2020-14058",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2020-14058.json",
      "version": "13"
    }
  }
}

ALSA-2020:4743

Vulnerability from osv_almalinux – Published: 2020-11-03 12:32 – Updated: 2020-11-03 19:54 – Source website

Summary

Moderate: squid:4 security, bug fix, and enhancement update

Details

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)
squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)
squid: Improper input validation in URI processor (CVE-2019-12523)
squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)
squid: Heap overflow issue in URN processing (CVE-2019-12526)
squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)
squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)
squid: Denial of service in cachemgr.cgi (CVE-2019-12854)
squid: Buffer overflow in URI processor (CVE-2019-18676)
squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)
squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)
squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)
squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)
squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)
squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)
squid: DoS in TLS handshake (CVE-2020-14058)
squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)
squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

URL

Type

	https://errata.almalinux.org/8/ALSA-2020-4743.html	ADVISORY
	https://vulners.com/cve/CVE-2019-12520	REPORT
	https://vulners.com/cve/CVE-2019-12521	REPORT
	https://vulners.com/cve/CVE-2019-12523	REPORT
	https://vulners.com/cve/CVE-2019-12524	REPORT
	https://vulners.com/cve/CVE-2019-12526	REPORT
	https://vulners.com/cve/CVE-2019-12528	REPORT
	https://vulners.com/cve/CVE-2019-12529	REPORT
	https://vulners.com/cve/CVE-2019-12854	REPORT
	https://vulners.com/cve/CVE-2019-18676	REPORT
	https://vulners.com/cve/CVE-2019-18677	REPORT
	https://vulners.com/cve/CVE-2019-18678	REPORT
	https://vulners.com/cve/CVE-2019-18679	REPORT
	https://vulners.com/cve/CVE-2019-18860	REPORT
	https://vulners.com/cve/CVE-2020-14058	REPORT
	https://vulners.com/cve/CVE-2020-15049	REPORT
	https://vulners.com/cve/CVE-2020-24606	REPORT
	https://vulners.com/cve/CVE-2020-8449	REPORT
	https://vulners.com/cve/CVE-2020-8450	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libecap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1-2.module_el8.6.0+2741+01592ae8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libecap-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1-2.module_el8.6.0+2741+01592ae8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nThe following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)\n\nSecurity Fix(es):\n\n* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n* squid: Improper input validation in URI processor (CVE-2019-12523)\n\n* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n* squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n* squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\n* squid: DoS in TLS handshake (CVE-2020-14058)\n\n* squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n* squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.",
  "id": "ALSA-2020:4743",
  "modified": "2020-11-03T19:54:15Z",
  "published": "2020-11-03T12:32:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2020-4743.html"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12520"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12521"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12523"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12524"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12526"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12528"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12529"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12854"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18676"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18677"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18678"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18679"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-18860"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14058"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-15049"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-24606"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-8449"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-8450"
    }
  ],
  "related": [
    "CVE-2019-12520",
    "CVE-2019-12521",
    "CVE-2019-12523",
    "CVE-2019-12524",
    "CVE-2019-12526",
    "CVE-2019-12528",
    "CVE-2019-12529",
    "CVE-2019-12854",
    "CVE-2019-18676",
    "CVE-2019-18677",
    "CVE-2019-18678",
    "CVE-2019-18679",
    "CVE-2019-18860",
    "CVE-2020-8449",
    "CVE-2020-8450",
    "CVE-2020-14058",
    "CVE-2020-15049",
    "CVE-2020-24606"
  ],
  "summary": "Moderate: squid:4 security, bug fix, and enhancement update"
}

CNVD-2020-51754

Vulnerability from cnvd - Published: 2020-09-11

Title

Squid代码问题漏洞

Description

Squid是一套代理服务器和Web缓存服务器软件。该软件提供缓存万维网、过滤流量、代理上网等功能。 Squid 4.12之前版本和5.0.3之前的5.x版本中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务。

Severity

中

Patch Name

Squid代码问题漏洞的补丁

Patch Description

Squid是一套代理服务器和Web缓存服务器软件。该软件提供缓存万维网、过滤流量、代理上网等功能。 Squid 4.12之前版本和5.0.3之前的5.x版本中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.squid-cache.org/Advisories/SQUID-2020_6.txt

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-14058

Impacted products

Name
['Squid Squid <4.12', 'Squid Squid 5.*，<5.0.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-14058"
    }
  },
  "description": "Squid\u662f\u4e00\u5957\u4ee3\u7406\u670d\u52a1\u5668\u548cWeb\u7f13\u5b58\u670d\u52a1\u5668\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u63d0\u4f9b\u7f13\u5b58\u4e07\u7ef4\u7f51\u3001\u8fc7\u6ee4\u6d41\u91cf\u3001\u4ee3\u7406\u4e0a\u7f51\u7b49\u529f\u80fd\u3002\n\nSquid 4.12\u4e4b\u524d\u7248\u672c\u548c5.0.3\u4e4b\u524d\u76845.x\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.squid-cache.org/Advisories/SQUID-2020_6.txt",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-51754",
  "openTime": "2020-09-11",
  "patchDescription": "Squid\u662f\u4e00\u5957\u4ee3\u7406\u670d\u52a1\u5668\u548cWeb\u7f13\u5b58\u670d\u52a1\u5668\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u63d0\u4f9b\u7f13\u5b58\u4e07\u7ef4\u7f51\u3001\u8fc7\u6ee4\u6d41\u91cf\u3001\u4ee3\u7406\u4e0a\u7f51\u7b49\u529f\u80fd\u3002\r\n\r\nSquid 4.12\u4e4b\u524d\u7248\u672c\u548c5.0.3\u4e4b\u524d\u76845.x\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Squid\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Squid Squid \u003c4.12",
      "Squid Squid 5.*\uff0c\u003c5.0.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-14058",
  "serverity": "\u4e2d",
  "submitTime": "2020-07-01",
  "title": "Squid\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}

FKIE_CVE-2020-14058

Vulnerability from fkie_nvd - Published: 2020-06-30 19:15 - Updated: 2026-06-17 02:54

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
cve@mitre.org	http://www.squid-cache.org/Advisories/SQUID-2020_6.txt	Vendor Advisory
cve@mitre.org	http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch	Patch, Vendor Advisory
cve@mitre.org	http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch	Patch, Vendor Advisory
cve@mitre.org	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/
cve@mitre.org	https://security.netapp.com/advisory/ntap-20210312-0001/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.squid-cache.org/Advisories/SQUID-2020_6.txt	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20210312-0001/	Third Party Advisory

Impacted products

Vendor	Product	Version
squid-cache	squid	*
squid-cache	squid	*
squid-cache	squid	*
fedoraproject	fedora	31
netapp	cloud_manager	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3828B8E-1FF7-4707-BB24-6C7CABC37362",
              "versionEndIncluding": "3.5.28",
              "versionStartIncluding": "3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3430B4A-4E1E-438D-9C84-4CFED6A3F023",
              "versionEndExcluding": "4.12",
              "versionStartIncluding": "4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "137B599B-80D1-4903-8791-40F11BC3FCD9",
              "versionEndExcluding": "5.0.3",
              "versionStartIncluding": "5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "197D0D80-6702-4B61-B681-AFDBA7D69067",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema en Squid versiones anteriores a 4.12 y versiones 5.x anteriores a  5.0.3. Debido al uso de una funci\u00f3n potencialmente peligrosa, Squid y el asistente de comprobaci\u00f3n de certificados predeterminado son vulnerables a una Denegaci\u00f3n de Servicio al abrir una conexi\u00f3n TLS en un servidor controlado por el atacante por HTTPS. Esto ocurre porque los valores de error no reconocidos son asignados a NULL, pero el c\u00f3digo posterior espera que cada valor de error sea asignado a una cadena de error v\u00e1lida"
    }
  ],
  "id": "CVE-2020-14058",
  "lastModified": "2026-06-17T02:54:09.890",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-06-30T19:15:11.130",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2020-14058

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2020-14058

Aliases

CVE-2020-14058

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-14058",
    "description": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.",
    "id": "GSD-2020-14058",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-14058.html",
      "https://access.redhat.com/errata/RHSA-2020:4743",
      "https://advisories.mageia.org/CVE-2020-14058.html",
      "https://linux.oracle.com/cve/CVE-2020-14058.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-14058"
      ],
      "details": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.",
      "id": "GSD-2020-14058",
      "modified": "2023-12-13T01:22:00.398690Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2020-14058",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch",
            "refsource": "MISC",
            "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
          },
          {
            "name": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch",
            "refsource": "MISC",
            "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
          },
          {
            "name": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt",
            "refsource": "CONFIRM",
            "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
          },
          {
            "name": "FEDORA-2020-cbebc5617e",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20210312-0001/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.5.28",
                "versionStartIncluding": "3.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.12",
                "versionStartIncluding": "4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.0.3",
                "versionStartIncluding": "5.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-14058"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch"
            },
            {
              "name": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.squid-cache.org/Advisories/SQUID-2020_6.txt"
            },
            {
              "name": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch"
            },
            {
              "name": "FEDORA-2020-cbebc5617e",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210312-0001/",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20210312-0001/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-04-28T18:57Z",
      "publishedDate": "2020-06-30T19:15Z"
    }
  }
}

OESA-2021-1092 (CVE-2020-14058)

Vulnerability from osv_openeuler – Published: 2021-03-26 11:04 – Updated: 2026-08-06 11:04 – Source website

Summary

squid security update

Details

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810)

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.(CVE-2020-15811)

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.(CVE-2020-24606)

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).(CVE-2020-11945)

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.(CVE-2020-15049)

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://openeuler.org/en/security/safety-bulletin…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-14058	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-15810	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-15811	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-24606	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-11945	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-15049	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "squid-debugsource-4.9-6.oe1.aarch64.rpm",
          "squid-debuginfo-4.9-6.oe1.aarch64.rpm",
          "squid-4.9-6.oe1.aarch64.rpm"
        ],
        "src": [
          "squid-4.9-6.oe1.src.rpm"
        ],
        "x86_64": [
          "squid-debugsource-4.9-6.oe1.x86_64.rpm",
          "squid-debuginfo-4.9-6.oe1.x86_64.rpm",
          "squid-4.9-6.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "squid",
        "purl": "pkg:rpm/openEuler/squid\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9-6.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.(CVE-2020-14058)\r\n\r\nAn issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810)\r\n\r\nAn issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.(CVE-2020-15811)\r\n\r\nSquid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.(CVE-2020-24606)\r\n\r\nAn issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).(CVE-2020-11945)\r\n\r\nAn issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing \u0026quot;+\\ \u0026quot;-\u0026quot; or an uncommon shell whitespace character prefix to the length field-value.(CVE-2020-15049)",
  "id": "OESA-2021-1092",
  "modified": "2026-08-06T11:04:19Z",
  "published": "2021-03-26T11:04:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1092"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14058"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15810"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15811"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24606"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11945"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15049"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "squid security update",
  "upstream": [
    "CVE-2020-14058",
    "CVE-2020-15810",
    "CVE-2020-15811",
    "CVE-2020-24606",
    "CVE-2020-11945",
    "CVE-2020-15049"
  ]
}

RHSA-2020:4743

Vulnerability from csaf_opensuse - Published: 2020-11-03 00:00 - Updated: 2026-09-20 11:12

Summary

security update for libecap

Severity

Moderate

Scope

18 vulnerabilities in this advisory, including CVE-2020-14058.

CVE-2020-14058

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Recommended: 3 products

Open the full advisory

RHSA-2020_4743

Vulnerability from csaf_redhat - Published: 2020-11-04 01:45 - Updated: 2024-11-22 15:13

Summary

Red Hat Security Advisory: squid:4 security, bug fix, and enhancement update

Severity

Moderate

Scope

18 vulnerabilities in this advisory, including CVE-2020-14058.

CVE-2020-14058

A flaw was found in squid. A denial-of-service attack while processing TLS certificates is possible due to use of a potentially dangerous function in Squid and the default certificate validation helper. The highest threat from this vulnerability is to system availability.

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Fixed: 31 products

https://access.redhat.com/errata/RHSA-2020:4743

Open the full advisory

WID-SEC-W-2023-1360

Vulnerability from csaf_certbund - Published: 2020-06-21 22:00 - Updated: 2023-06-06 22:00

Summary

Squid: Mehrere Schwachstellen ermöglichen Denial of Service

Severity

Hoch

Scope

2 vulnerabilities in this advisory, including CVE-2020-14058.

CVE-2020-14058

Es existiert eine Schwachstelle in Squid bei der Verarbeitung von TLS-Zertifikaten. Diese Schwachstelle besteht nur dann, wenn Squid mit OpenSSL-Funktionen gebaut wurde und Peer- oder Server-Verbindungen für HTTPS-Verkehr und SSL-Bump-Server-Handshakes öffnet. Ein entfernter anonymer Angreifer kann diese Schwachstelle ausnutzen, um beim Öffnen von TLS-Verbindungen mit einem HTTPS Server einen Denial-of-Service-Angriff durchzuführen.

Known affected: 3 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-14058 (GCVE-0-2020-14058)

ALSA-2020:4743

CNVD-2020-51754

FKIE_CVE-2020-14058

GSD-2020-14058

OESA-2021-1092 (CVE-2020-14058)

RHSA-2020:4743

RHSA-2020_4743

WID-SEC-W-2023-1360

Tags

Sightings

Nomenclature

Related by attack behaviour