logo
DATABASE RESOURCES PRICING ABOUT US

[SECURITY] [DLA 2028-1] squid3 security update

Description

Package : squid3 Version : 3.4.8-6+deb8u9 CVE ID : CVE-2019-12526 CVE-2019-18677 CVE-2019-18678 CVE-2019-18679 It was found that Squid, a high-performance proxy caching server for web clients, has been affected by the following security vulnerabilities. CVE-2019-12526 URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap. CVE-2019-18677 When the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions), it can inappropriately redirect traffic to origins it should not be delivered to. This happens because of incorrect message processing. CVE-2019-18678 A programming error allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. CVE-2019-18679 Due to incorrect data management, Squid is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks. For Debian 8 "Jessie", these problems have been fixed in version 3.4.8-6+deb8u9. We recommend that you upgrade your squid3 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS


Affected Package


OS OS Version Package Name Package Version
Debian 8 squid3 3.4.8-6+deb8u9
Debian 10 squid 4.6-1+deb10u2
Debian 10 squidclient 4.6-1+deb10u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 10 squidclient 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2
Debian 9 squid 3.5.23-5+deb9u2
Debian 8 squid-cgi 3.4.8-6+deb8u9
Debian 9 squid-cgi 3.5.23-5+deb9u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 8 squidclient 3.4.8-6+deb8u9
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 9 squid-purge 3.5.23-5+deb9u2
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 8 squid3 3.4.8-6+deb8u9
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 9 squidclient 3.5.23-5+deb9u2
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 8 squidclient 3.4.8-6+deb8u9
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2
Debian 9 squid-cgi 3.5.23-5+deb9u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 9 squid-cgi 3.5.23-5+deb9u2
Debian 8 squid-purge 3.4.8-6+deb8u9
Debian 9 squid-purge 3.5.23-5+deb9u2
Debian 8 squid-cgi 3.4.8-6+deb8u9
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 9 squidclient 3.5.23-5+deb9u2
Debian 8 squid3-dbg 3.4.8-6+deb8u9
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 8 squid3 3.4.8-6+deb8u9
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 8 squid3-dbg 3.4.8-6+deb8u9
Debian 10 squid-purge 4.6-1+deb10u2
Debian 8 squid3-dbg 3.4.8-6+deb8u9
Debian 8 squid-cgi 3.4.8-6+deb8u9
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 10 squidclient 4.6-1+deb10u2
Debian 8 squidclient 3.4.8-6+deb8u9
Debian 10 squid3 4.6-1+deb10u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 8 squid-purge 3.4.8-6+deb8u9
Debian 10 squidclient 4.6-1+deb10u2
Debian 10 squidclient 4.6-1+deb10u2
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squidclient 4.6-1+deb10u2
Debian 9 squidclient 3.5.23-5+deb9u2
Debian 9 squid3 3.5.23-5+deb9u2
Debian 9 squid 3.5.23-5+deb9u2
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 9 squid-dbg 3.5.23-5+deb9u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 9 squidclient 3.5.23-5+deb9u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2
Debian 9 squid 3.5.23-5+deb9u2
Debian 9 squid-cgi 3.5.23-5+deb9u2
Debian 9 squid-cgi 3.5.23-5+deb9u2
Debian 9 squid-common 3.5.23-5+deb9u2
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2
Debian 10 squidclient 4.6-1+deb10u2
Debian 9 squid-dbg 3.5.23-5+deb9u2
Debian 9 squid-purge 3.5.23-5+deb9u2
Debian 10 squid-cgi-dbgsym 4.6-1+deb10u2
Debian 10 squidclient 4.6-1+deb10u2
Debian 9 squid 3.5.23-5+deb9u2
Debian 9 squid-purge 3.5.23-5+deb9u2
Debian 8 squid-cgi 3.4.8-6+deb8u9
Debian 8 squid3-common 3.4.8-6+deb8u9
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 8 squid-purge 3.4.8-6+deb8u9
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 10 squid-common 4.6-1+deb10u2
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 9 squid-dbg 3.5.23-5+deb9u2
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 9 squid-purge 3.5.23-5+deb9u2
Debian 8 squidclient 3.4.8-6+deb8u9
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 10 squidclient 4.6-1+deb10u2
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2
Debian 10 squid-cgi 4.6-1+deb10u2
Debian 10 squid-dbgsym 4.6-1+deb10u2
Debian 9 squid 3.5.23-5+deb9u2
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 8 squid3 3.4.8-6+deb8u9
Debian 10 squidclient 4.6-1+deb10u2
Debian 9 squid-dbg 3.5.23-5+deb9u2
Debian 10 squid 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2
Debian 8 squid-purge 3.4.8-6+deb8u9
Debian 8 squid3-dbg 3.4.8-6+deb8u9
Debian 9 squidclient 3.5.23-5+deb9u2
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 8 squid3 3.4.8-6+deb8u9
Debian 9 squid-dbg 3.5.23-5+deb9u2
Debian 10 squid-purge-dbgsym 4.6-1+deb10u2
Debian 10 squid 4.6-1+deb10u2
Debian 10 squidclient-dbgsym 4.6-1+deb10u2
Debian 10 squid-purge 4.6-1+deb10u2

Related