squid security update

CentOS Errata and Security Advisory CESA-2020:4082

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

• squid: HTTP Request Smuggling could result in cache poisoning (CVE-2020-15810)

• squid: HTTP Request Splitting could result in cache poisoning (CVE-2020-15811)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2020-November/032956.html

Affected packages:
squid
squid-migration-script
squid-sysvinit

Upstream details at:
https://access.redhat.com/errata/RHSA-2020:4082