DATABASE RESOURCES PRICING ABOUT US

{"id": "DEBIAN:DSA-4732-1:7F364", "vendorId": null, "type": "debian", "bulletinFamily": "unix", "title": "[SECURITY] [DSA 4732-1] squid security update", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4732-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nJuly 21, 2020 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : squid\nCVE ID : CVE-2019-18860 CVE-2020-1504\n\nTwo security issues were discovered in the Squid proxy caching\nserver, which could result in cache poisoning, request smuggling\nand incomplete validation of hostnames in cachemgr.cgi.\n\nFor the stable distribution (buster), these problems have been fixed in\nversion 4.6-1+deb10u3.\n\nWe recommend that you upgrade your squid packages.\n\nFor the detailed security status of squid please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/squid\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "published": "2020-07-21T19:07:22", "modified": "2020-07-21T19:07:22", "epss": [{"cve": "CVE-2019-18860", "epss": 0.00241, "percentile": 0.61788, "modified": "2023-12-03"}, {"cve": "CVE-2020-1504", "epss": 0.04885, "percentile": 0.91886, "modified": "2023-12-03"}], "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 9.3}, "severity": "HIGH", "exploitabilityScore": 8.6, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, "href": "https://lists.debian.org/debian-security-announce/2020/msg00138.html", "reporter": "Debian", "references": [], "cvelist": ["CVE-2019-18860", "CVE-2020-1504"], "immutableFields": [], "lastseen": "2023-12-04T10:26:21", "viewCount": 26, "enchantments": {"dependencies": {"references": [{"type": "almalinux", "idList": ["ALSA-2020:4743"]}, {"type": "amazon", "idList": ["ALAS-2023-2318", "ALAS2-2023-2318"]}, {"type": "avleonov", "idList": ["AVLEONOV:F17F36C3CC642EBDC27E43900FE3905E"]}, {"type": "cve", "idList": ["CVE-2019-18860", "CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"]}, {"type": "debian", "idList": ["DEBIAN:DLA-2278-1:4A30F", "DEBIAN:DLA-2278-1:83AD0"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2019-18860"]}, {"type": "kaspersky", "idList": ["KLA11932"]}, {"type": "mscve", "idList": ["MS:CVE-2020-1504"]}, {"type": "mskb", "idList": ["KB4484461"]}, {"type": "nessus", "idList": ["AL2_ALAS-2023-2318.NASL", "CENTOS8_RHSA-2020-4743.NASL", "DEBIAN_DSA-4732.NASL", "EULEROS_SA-2020-2534.NASL", "EULEROS_SA-2021-1234.NASL", "OPENSUSE-2020-623.NASL", "ORACLELINUX_ELSA-2020-4743.NASL", "REDHAT-RHSA-2020-4743.NASL", "ROCKY_LINUX_RLSA-2020-4743.NASL", "SMB_NT_MS20_AUG_EXCEL.NASL", "SMB_NT_MS20_AUG_EXCEL_C2R.NASL", "SUSE_SU-2020-1134-1.NASL", "SUSE_SU-2020-1156-1.NASL", "SUSE_SU-2020-14460-1.NASL", "SUSE_SU-2020-1803-1.NASL", "UBUNTU_USN-4356-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310143623", "OPENVAS:1361412562310844426", "OPENVAS:1361412562310853156", "OPENVAS:1361412562310892278"]}, {"type": "oraclelinux", "idList": ["ELSA-2020-4743"]}, {"type": "osv", "idList": ["OSV:DLA-2278-1", "OSV:DSA-4732-1"]}, {"type": "prion", "idList": ["PRION:CVE-2019-18860", "PRION:CVE-2020-1494", "PRION:CVE-2020-1495", "PRION:CVE-2020-1496", "PRION:CVE-2020-1498", "PRION:CVE-2020-1504"]}, {"type": "redhat", "idList": ["RHSA-2020:4743"]}, {"type": "redhatcve", "idList": ["RH:CVE-2019-18860"]}, {"type": "rocky", "idList": ["RLSA-2020:4743"]}, {"type": "rosalinux", "idList": ["ROSA-SA-2021-1976"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:0623-1"]}, {"type": "ubuntu", "idList": ["USN-4356-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2019-18860"]}, {"type": "veracode", "idList": ["VERACODE:27064"]}]}, "score": {"value": 0.4, "vector": "NONE"}, "backreferences": {"references": [{"type": "almalinux", "idList": ["ALSA-2020:4743"]}, {"type": "avleonov", "idList": ["AVLEONOV:F17F36C3CC642EBDC27E43900FE3905E"]}, {"type": "cve", "idList": ["CVE-2019-18860"]}, {"type": "debian", "idList": ["DEBIAN:DLA-2278-1:83AD0"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2019-18860"]}, {"type": "kaspersky", "idList": ["KLA11932"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2019-18860/", "MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2019-18860/"]}, {"type": "mscve", "idList": ["MS:CVE-2020-1504"]}, {"type": "mskb", "idList": ["KB4484461"]}, {"type": "nessus", "idList": ["OPENSUSE-2020-623.NASL", "SUSE_SU-2020-1134-1.NASL", "SUSE_SU-2020-1156-1.NASL", "SUSE_SU-2020-14460-1.NASL", "SUSE_SU-2020-1803-1.NASL", "UBUNTU_USN-4356-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310143623", "OPENVAS:1361412562310844426", "OPENVAS:1361412562310853156"]}, {"type": "oraclelinux", "idList": ["ELSA-2020-4743"]}, {"type": "redhatcve", "idList": ["RH:CVE-2019-18860"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:0623-1"]}, {"type": "ubuntu", "idList": ["USN-4356-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2019-18860"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2019-18860", "epss": 0.00245, "percentile": 0.60968, "modified": "2023-05-03"}, {"cve": "CVE-2020-1504", "epss": 0.06417, "percentile": 0.9259, "modified": "2023-05-03"}], "vulnersScore": 0.4}, "_state": {"dependencies": 1701685607, "score": 1701685796, "epss": 0}, "_internal": {"score_hash": "c23b1e3d5c72ea71f4cf0df534225a43"}, "affectedPackage": [{"OSVersion": "10", "arch": "mips", "OS": "Debian", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_mips.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"OSVersion": "10", "arch": "mips", "packageFilename": "squid-purge_4.6-1+deb10u3_mips.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "packageFilename": "squid-purge_4.6-1+deb10u3_mipsel.deb", "arch": "mipsel", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_i386.deb", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "i386", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"OSVersion": "10", "OS": "Debian", "packageFilename": "squid-purge_4.6-1+deb10u3_amd64.deb", "arch": "amd64", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "arch": "all", "OS": "Debian", "packageFilename": "squid3_4.6-1+deb10u3_all.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid3"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "operator": "lt", "OSVersion": "9", "arch": "armhf", "packageFilename": "squid_3.5.23-5+deb9u2_armhf.deb", "packageName": "squid"}, {"OSVersion": "10", "arch": "arm64", "packageFilename": "squidclient_4.6-1+deb10u3_arm64.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "OSVersion": "9", "packageFilename": "squid-dbg_3.5.23-5+deb9u2_armhf.deb", "arch": "armhf", "operator": "lt", "packageName": "squid-dbg"}, {"OSVersion": "10", "OS": "Debian", "arch": "amd64", "packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_amd64.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"arch": "mips64el", "OSVersion": "10", "OS": "Debian", "packageFilename": "squid-cgi_4.6-1+deb10u3_mips64el.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi"}, {"packageFilename": "squidclient_4.6-1+deb10u3_armhf.deb", "OSVersion": "10", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "arch": "armhf", "operator": "lt", "packageName": "squidclient"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "packageFilename": "squid-cgi_3.5.23-5+deb9u2_armhf.deb", "OSVersion": "9", "arch": "armhf", "operator": "lt", "packageName": "squid-cgi"}, {"arch": "mips64el", "OSVersion": "10", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_mips64el.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"packageFilename": "squid-cgi_3.5.23-5+deb9u2_arm64.deb", "packageVersion": "3.5.23-5+deb9u2", "arch": "arm64", "OS": "Debian", "OSVersion": "9", "operator": "lt", "packageName": "squid-cgi"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_s390x.deb", "arch": "s390x", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"OSVersion": "10", "arch": "armel", "OS": "Debian", "operator": "lt", "packageVersion": "4.6-1+deb10u3", "packageFilename": "squid-cgi_4.6-1+deb10u3_armel.deb", "packageName": "squid-cgi"}, {"OSVersion": "10", "arch": "ppc64el", "OS": "Debian", "packageFilename": "squidclient_4.6-1+deb10u3_ppc64el.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "OSVersion": "9", "arch": "amd64", "packageFilename": "squid-purge_3.5.23-5+deb9u2_amd64.deb", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_i386.deb", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "i386", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"OSVersion": "10", "packageFilename": "squidclient_4.6-1+deb10u3_armel.deb", "arch": "armel", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient"}, {"OSVersion": "10", "OS": "Debian", "packageFilename": "squid_4.6-1+deb10u3_armhf.deb", "packageVersion": "4.6-1+deb10u3", "arch": "armhf", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "OS": "Debian", "arch": "armhf", "packageVersion": "4.6-1+deb10u3", "packageFilename": "squid-cgi_4.6-1+deb10u3_armhf.deb", "operator": "lt", "packageName": "squid-cgi"}, {"arch": "mips64el", "OSVersion": "10", "OS": "Debian", "operator": "lt", "packageVersion": "4.6-1+deb10u3", "packageFilename": "squid-purge_4.6-1+deb10u3_mips64el.deb", "packageName": "squid-purge"}, {"packageVersion": "3.5.23-5+deb9u2", "packageFilename": "squidclient_3.5.23-5+deb9u2_arm64.deb", "arch": "arm64", "OS": "Debian", "OSVersion": "9", "operator": "lt", "packageName": "squidclient"}, {"OSVersion": "10", "packageFilename": "squid_4.6-1+deb10u3_i386.deb", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "i386", "operator": "lt", "packageName": "squid"}, {"packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_mips.deb", "OSVersion": "10", "arch": "mips", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_mipsel.deb", "OSVersion": "10", "arch": "mipsel", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "OSVersion": "9", "packageFilename": "squid-purge_3.5.23-5+deb9u2_armhf.deb", "arch": "armhf", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "arch": "mipsel", "OS": "Debian", "operator": "lt", "packageVersion": "4.6-1+deb10u3", "packageFilename": "squidclient_4.6-1+deb10u3_mipsel.deb", "packageName": "squidclient"}, {"packageVersion": "3.5.23-5+deb9u2", "packageFilename": "squid_3.5.23-5+deb9u2_i386.deb", "OS": "Debian", "OSVersion": "9", "arch": "i386", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "arch": "ppc64el", "OS": "Debian", "packageFilename": "squid-purge_4.6-1+deb10u3_ppc64el.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "packageFilename": "squidclient_4.6-1+deb10u3_s390x.deb", "arch": "s390x", "operator": "lt", "packageName": "squidclient"}, {"OSVersion": "10", "OS": "Debian", "arch": "armhf", "operator": "lt", "packageVersion": "4.6-1+deb10u3", "packageFilename": "squid-dbgsym_4.6-1+deb10u3_armhf.deb", "packageName": "squid-dbgsym"}, {"packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_s390x.deb", "OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "s390x", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "i386", "packageFilename": "squidclient_4.6-1+deb10u3_i386.deb", "operator": "lt", "packageName": "squidclient"}, {"OSVersion": "10", "arch": "ppc64el", "packageFilename": "squid_4.6-1+deb10u3_ppc64el.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "arch": "armel", "OS": "Debian", "packageFilename": "squid-dbgsym_4.6-1+deb10u3_armel.deb", "operator": "lt", "packageVersion": "4.6-1+deb10u3", "packageName": "squid-dbgsym"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "packageFilename": "squidclient_3.5.23-5+deb9u2_i386.deb", "OSVersion": "9", "arch": "i386", "operator": "lt", "packageName": "squidclient"}, {"OSVersion": "10", "packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_armel.deb", "arch": "armel", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "OSVersion": "9", "packageFilename": "squidclient_3.5.23-5+deb9u2_armhf.deb", "arch": "armhf", "operator": "lt", "packageName": "squidclient"}, {"packageFilename": "squid-dbgsym_4.6-1+deb10u3_mips64el.deb", "arch": "mips64el", "OSVersion": "10", "OS": "Debian", "operator": "lt", "packageVersion": "4.6-1+deb10u3", "packageName": "squid-dbgsym"}, {"packageFilename": "squid-cgi_4.6-1+deb10u3_s390x.deb", "OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "s390x", "operator": "lt", "packageName": "squid-cgi"}, {"OSVersion": "10", "packageFilename": "squid-dbgsym_4.6-1+deb10u3_arm64.deb", "arch": "arm64", "OS": "Debian", "operator": "lt", "packageVersion": "4.6-1+deb10u3", "packageName": "squid-dbgsym"}, {"packageFilename": "squid_4.6-1+deb10u3_all.deb", "OSVersion": "10", "arch": "all", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "packageFilename": "squid-dbgsym_4.6-1+deb10u3_i386.deb", "operator": "lt", "arch": "i386", "packageName": "squid-dbgsym"}, {"OSVersion": "10", "OS": "Debian", "arch": "armhf", "packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_armhf.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "OSVersion": "9", "packageFilename": "squid-cgi_3.5.23-5+deb9u2_i386.deb", "arch": "i386", "operator": "lt", "packageName": "squid-cgi"}, {"packageVersion": "3.5.23-5+deb9u2", "packageFilename": "squid-purge_3.5.23-5+deb9u2_arm64.deb", "arch": "arm64", "OS": "Debian", "OSVersion": "9", "operator": "lt", "packageName": "squid-purge"}, {"packageVersion": "3.5.23-5+deb9u2", "arch": "armel", "OS": "Debian", "OSVersion": "9", "packageFilename": "squidclient_3.5.23-5+deb9u2_armel.deb", "operator": "lt", "packageName": "squidclient"}, {"packageVersion": "3.5.23-5+deb9u2", "arch": "arm64", "OS": "Debian", "packageFilename": "squid_3.5.23-5+deb9u2_arm64.deb", "OSVersion": "9", "operator": "lt", "packageName": "squid"}, {"arch": "mips64el", "OSVersion": "10", "OS": "Debian", "packageFilename": "squidclient_4.6-1+deb10u3_mips64el.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient"}, {"packageFilename": "squid-dbg_3.5.23-5+deb9u2_arm64.deb", "packageVersion": "3.5.23-5+deb9u2", "arch": "arm64", "OS": "Debian", "OSVersion": "9", "operator": "lt", "packageName": "squid-dbg"}, {"OSVersion": "10", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_arm64.deb", "arch": "arm64", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "packageFilename": "squidclient_3.5.23-5+deb9u2_amd64.deb", "OSVersion": "9", "arch": "amd64", "operator": "lt", "packageName": "squidclient"}, {"OSVersion": "10", "arch": "arm64", "OS": "Debian", "packageFilename": "squid-cgi_4.6-1+deb10u3_arm64.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi"}, {"packageVersion": "3.5.23-5+deb9u2", "arch": "armel", "OS": "Debian", "packageFilename": "squid_3.5.23-5+deb9u2_armel.deb", "OSVersion": "9", "operator": "lt", "packageName": "squid"}, {"packageVersion": "3.5.23-5+deb9u2", "arch": "armel", "OS": "Debian", "OSVersion": "9", "packageFilename": "squid-dbg_3.5.23-5+deb9u2_armel.deb", "operator": "lt", "packageName": "squid-dbg"}, {"OSVersion": "10", "OS": "Debian", "arch": "amd64", "packageVersion": "4.6-1+deb10u3", "packageFilename": "squid_4.6-1+deb10u3_amd64.deb", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_arm64.deb", "arch": "arm64", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"OSVersion": "10", "packageFilename": "squid_4.6-1+deb10u3_armel.deb", "arch": "armel", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "packageFilename": "squid-purge_4.6-1+deb10u3_s390x.deb", "arch": "s390x", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "arch": "mips", "packageFilename": "squidclient_4.6-1+deb10u3_mips.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient"}, {"OSVersion": "10", "arch": "all", "OS": "Debian", "packageFilename": "squid-common_4.6-1+deb10u3_all.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-common"}, {"OSVersion": "10", "arch": "ppc64el", "OS": "Debian", "operator": "lt", "packageFilename": "squid-dbgsym_4.6-1+deb10u3_ppc64el.deb", "packageVersion": "4.6-1+deb10u3", "packageName": "squid-dbgsym"}, {"OSVersion": "10", "arch": "arm64", "OS": "Debian", "packageFilename": "squid-purge_4.6-1+deb10u3_arm64.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge"}, {"packageFilename": "squid-common_3.5.23-5+deb9u2_all.deb", "packageVersion": "3.5.23-5+deb9u2", "arch": "all", "OS": "Debian", "OSVersion": "9", "operator": "lt", "packageName": "squid-common"}, {"OSVersion": "10", "OS": "Debian", "arch": "amd64", "packageFilename": "squid-cgi_4.6-1+deb10u3_amd64.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi"}, {"OSVersion": "10", "arch": "armel", "OS": "Debian", "packageFilename": "squid-purge_4.6-1+deb10u3_armel.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge"}, {"packageFilename": "squid-cgi_4.6-1+deb10u3_ppc64el.deb", "OSVersion": "10", "arch": "ppc64el", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi"}, {"OSVersion": "10", "packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_s390x.deb", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "s390x", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"OSVersion": "10", "OS": "Debian", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_amd64.deb", "arch": "amd64", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"OSVersion": "10", "arch": "mipsel", "OS": "Debian", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_mipsel.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"OSVersion": "10", "arch": "ppc64el", "packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_ppc64el.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"OSVersion": "10", "arch": "mipsel", "OS": "Debian", "packageFilename": "squid-cgi_4.6-1+deb10u3_mipsel.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi"}, {"packageFilename": "squid-cgi_4.6-1+deb10u3_mips.deb", "OSVersion": "10", "arch": "mips", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi"}, {"arch": "mips64el", "OSVersion": "10", "packageFilename": "squid_4.6-1+deb10u3_mips64el.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "arch": "mips", "OS": "Debian", "operator": "lt", "packageFilename": "squid-dbgsym_4.6-1+deb10u3_mips.deb", "packageVersion": "4.6-1+deb10u3", "packageName": "squid-dbgsym"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "packageFilename": "squid-purge_4.6-1+deb10u3_i386.deb", "arch": "i386", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "arch": "mipsel", "packageFilename": "squid_4.6-1+deb10u3_mipsel.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "OS": "Debian", "packageFilename": "squid-dbgsym_4.6-1+deb10u3_amd64.deb", "operator": "lt", "arch": "amd64", "packageVersion": "4.6-1+deb10u3", "packageName": "squid-dbgsym"}, {"OSVersion": "10", "arch": "armel", "OS": "Debian", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_armel.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"packageFilename": "squid-dbgsym_4.6-1+deb10u3_mipsel.deb", "OSVersion": "10", "arch": "mipsel", "OS": "Debian", "operator": "lt", "packageVersion": "4.6-1+deb10u3", "packageName": "squid-dbgsym"}, {"OSVersion": "10", "OS": "Debian", "packageFilename": "squid-purge_4.6-1+deb10u3_armhf.deb", "packageVersion": "4.6-1+deb10u3", "arch": "armhf", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "packageFilename": "squid_4.6-1+deb10u3_s390x.deb", "arch": "s390x", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "OS": "Debian", "arch": "amd64", "packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_amd64.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"OSVersion": "10", "arch": "mipsel", "packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_mipsel.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"packageFilename": "squid-dbg_3.5.23-5+deb9u2_i386.deb", "packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "OSVersion": "9", "arch": "i386", "operator": "lt", "packageName": "squid-dbg"}, {"packageVersion": "3.5.23-5+deb9u2", "arch": "armel", "OS": "Debian", "OSVersion": "9", "packageFilename": "squid-cgi_3.5.23-5+deb9u2_armel.deb", "operator": "lt", "packageName": "squid-cgi"}, {"packageVersion": "3.5.23-5+deb9u2", "arch": "armel", "OS": "Debian", "OSVersion": "9", "packageFilename": "squid-purge_3.5.23-5+deb9u2_armel.deb", "operator": "lt", "packageName": "squid-purge"}, {"OSVersion": "10", "OS": "Debian", "packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_armhf.deb", "packageVersion": "4.6-1+deb10u3", "arch": "armhf", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"packageVersion": "3.5.23-5+deb9u2", "packageFilename": "squid-purge_3.5.23-5+deb9u2_i386.deb", "OS": "Debian", "OSVersion": "9", "arch": "i386", "operator": "lt", "packageName": "squid-purge"}, {"packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_i386.deb", "OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "i386", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "packageFilename": "squid-cgi_4.6-1+deb10u3_i386.deb", "arch": "i386", "operator": "lt", "packageName": "squid-cgi"}, {"packageVersion": "3.5.23-5+deb9u2", "arch": "all", "packageFilename": "squid3_3.5.23-5+deb9u2_all.deb", "OS": "Debian", "OSVersion": "9", "operator": "lt", "packageName": "squid3"}, {"OSVersion": "10", "arch": "ppc64el", "packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_ppc64el.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"OSVersion": "10", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "arch": "amd64", "packageFilename": "squidclient_4.6-1+deb10u3_amd64.deb", "operator": "lt", "packageName": "squidclient"}, {"packageVersion": "3.5.23-5+deb9u2", "packageFilename": "squid_3.5.23-5+deb9u2_amd64.deb", "OS": "Debian", "OSVersion": "9", "arch": "amd64", "operator": "lt", "packageName": "squid"}, {"arch": "mips64el", "OSVersion": "10", "packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_mips64el.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "OSVersion": "9", "arch": "amd64", "packageFilename": "squid-cgi_3.5.23-5+deb9u2_amd64.deb", "operator": "lt", "packageName": "squid-cgi"}, {"OSVersion": "10", "packageFilename": "squid_4.6-1+deb10u3_arm64.deb", "arch": "arm64", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid"}, {"packageVersion": "3.5.23-5+deb9u2", "OS": "Debian", "packageFilename": "squid-dbg_3.5.23-5+deb9u2_amd64.deb", "OSVersion": "9", "arch": "amd64", "operator": "lt", "packageName": "squid-dbg"}, {"OSVersion": "10", "arch": "arm64", "OS": "Debian", "packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_arm64.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"OSVersion": "10", "arch": "ppc64el", "OS": "Debian", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_ppc64el.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"OSVersion": "10", "packageFilename": "squid-dbgsym_4.6-1+deb10u3_s390x.deb", "packageVersion": "4.6-1+deb10u3", "OS": "Debian", "operator": "lt", "arch": "s390x", "packageName": "squid-dbgsym"}, {"arch": "mips64el", "OSVersion": "10", "OS": "Debian", "packageFilename": "squidclient-dbgsym_4.6-1+deb10u3_mips64el.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squidclient-dbgsym"}, {"OSVersion": "10", "arch": "mips", "OS": "Debian", "packageFilename": "squid_4.6-1+deb10u3_mips.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid"}, {"OSVersion": "10", "packageFilename": "squid-cgi-dbgsym_4.6-1+deb10u3_armhf.deb", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "arch": "armhf", "operator": "lt", "packageName": "squid-cgi-dbgsym"}, {"OSVersion": "10", "arch": "mips", "OS": "Debian", "packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_mips.deb", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge-dbgsym"}, {"packageFilename": "squid-purge-dbgsym_4.6-1+deb10u3_armel.deb", "OSVersion": "10", "arch": "armel", "OS": "Debian", "packageVersion": "4.6-1+deb10u3", "operator": "lt", "packageName": "squid-purge-dbgsym"}]}

{"veracode": [{"lastseen": "2023-04-18T12:43:57", "description": "Squid is vulnerable to open redirection. When certain web browsers are used, HTML in the `hostname` parameter is mishandled to `cachemgr.cgi`.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2020-09-21T06:33:21", "type": "veracode", "title": "Open Redirection", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-18860"], "modified": "2023-01-24T06:25:32", "id": "VERACODE:27064", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-27064/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "cve": [{"lastseen": "2023-12-03T15:12:13", "description": "Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2020-03-20T21:15:00", "type": "cve", "title": "CVE-2019-18860", "cwe": ["CWE-74"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-18860"], "modified": "2023-01-24T02:12:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:20.04", "cpe:/o:canonical:ubuntu_linux:18.04", "cpe:/o:canonical:ubuntu_linux:19.10", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:opensuse:leap:15.1", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:debian:debian_linux:10.0"], "id": "CVE-2019-18860", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18860", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-03T15:14:53", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1495, CVE-2020-1496, CVE-2020-1498.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "cve", "title": "CVE-2020-1504", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "cpe": ["cpe:/a:microsoft:excel:2010"], "id": "CVE-2020-1504", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1504", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*"]}, {"lastseen": "2023-12-03T15:14:26", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1495, CVE-2020-1496, CVE-2020-1498, CVE-2020-1504.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "cve", "title": "CVE-2020-1494", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "cpe": ["cpe:/a:microsoft:365_apps:-", "cpe:/a:microsoft:excel:2013", "cpe:/a:microsoft:office:2010", "cpe:/a:microsoft:excel:2016", "cpe:/a:microsoft:office:2016", "cpe:/a:microsoft:office:2013", "cpe:/a:microsoft:office:2019", "cpe:/a:microsoft:excel:2010"], "id": "CVE-2020-1494", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1494", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*", "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*", "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*", "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*", "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*"]}, {"lastseen": "2023-12-03T15:14:37", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1495, CVE-2020-1496, CVE-2020-1504.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "cve", "title": "CVE-2020-1498", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "cpe": ["cpe:/a:microsoft:365_apps:-", "cpe:/a:microsoft:excel:2013", "cpe:/a:microsoft:excel:2016", "cpe:/a:microsoft:office:2016", "cpe:/a:microsoft:office:2019", "cpe:/a:microsoft:excel:2010"], "id": "CVE-2020-1498", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1498", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*", "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*", "cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*", "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2016:*:*:*:*:macos:*:*", "cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*", "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*"]}, {"lastseen": "2023-12-03T15:14:29", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1495, CVE-2020-1498, CVE-2020-1504.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "cve", "title": "CVE-2020-1496", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "cpe": ["cpe:/a:microsoft:365_apps:-", "cpe:/a:microsoft:excel:2013", "cpe:/a:microsoft:office:2010", "cpe:/a:microsoft:excel:2016", "cpe:/a:microsoft:office:2016", "cpe:/a:microsoft:office:2013", "cpe:/a:microsoft:office:2019", "cpe:/a:microsoft:excel:2010"], "id": "CVE-2020-1496", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1496", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*", "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*", "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*", "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*", "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*"]}, {"lastseen": "2023-12-03T15:14:28", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1496, CVE-2020-1498, CVE-2020-1504.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "cve", "title": "CVE-2020-1495", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "cpe": ["cpe:/a:microsoft:365_apps:-", "cpe:/a:microsoft:excel:2013", "cpe:/a:microsoft:office:2010", "cpe:/a:microsoft:excel:2016", "cpe:/a:microsoft:sharepoint_server:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2013", "cpe:/a:microsoft:office:2016", "cpe:/a:microsoft:office:2013", "cpe:/a:microsoft:office:2019", "cpe:/a:microsoft:excel:2010", "cpe:/a:microsoft:office_online_server:-"], "id": "CVE-2020-1495", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1495", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*", "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*", "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*", "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*", "cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office:2016:*:*:*:*:macos:*:*", "cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*", "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*"]}], "prion": [{"lastseen": "2023-11-22T02:08:02", "description": "Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2020-03-20T21:15:00", "type": "prion", "title": "Hardcoded credentials", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-18860"], "modified": "2023-01-24T02:12:00", "id": "PRION:CVE-2019-18860", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-18860", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-11-22T01:20:57", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1495, CVE-2020-1496, CVE-2020-1498, CVE-2020-1504.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "prion", "title": "Remote code execution", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2020-1494", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2020-1494", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T01:21:00", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1495, CVE-2020-1496, CVE-2020-1504.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "prion", "title": "Remote code execution", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2020-1498", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2020-1498", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T01:20:57", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1496, CVE-2020-1498, CVE-2020-1504.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "prion", "title": "Remote code execution", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2020-1495", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2020-1495", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T01:20:58", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1495, CVE-2020-1498, CVE-2020-1504.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "prion", "title": "Remote code execution", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2020-1496", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2020-1496", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T01:21:06", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1495, CVE-2020-1496, CVE-2020-1498.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-17T19:15:00", "type": "prion", "title": "Remote code execution", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2020-1504", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2020-1504", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "ubuntucve": [{"lastseen": "2023-12-03T14:06:55", "description": "Squid before 4.9, when certain web browsers are used, mishandles HTML in\nthe host (aka hostname) parameter to cachemgr.cgi.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2020-03-20T00:00:00", "type": "ubuntucve", "title": "CVE-2019-18860", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-18860"], "modified": "2020-03-20T00:00:00", "id": "UB:CVE-2019-18860", "href": "https://ubuntu.com/security/CVE-2019-18860", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "openvas": [{"lastseen": "2020-03-31T16:38:33", "description": "Squid, when certain web browsers are used, mishandles HTML in the host (aka\n hostname) parameter to cachemgr.cgi.", "cvss3": {}, "published": "2020-03-23T00:00:00", "type": "openvas", "title": "Squid Proxy Cache < 4.9 Hostname Validation Vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-18860"], "modified": "2020-03-30T00:00:00", "id": "OPENVAS:1361412562310143623", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310143623", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/a:squid-cache:squid\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.143623\");\n script_version(\"2020-03-30T06:46:24+0000\");\n script_tag(name:\"last_modification\", value:\"2020-03-30 06:46:24 +0000 (Mon, 30 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-03-23 04:00:09 +0000 (Mon, 23 Mar 2020)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_cve_id(\"CVE-2019-18860\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_name(\"Squid Proxy Cache < 4.9 Hostname Validation Vulnerability\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"secpod_squid_detect.nasl\");\n script_mandatory_keys(\"squid_proxy_server/installed\");\n\n script_tag(name:\"summary\", value:\"Squid, when certain web browsers are used, mishandles HTML in the host (aka\n hostname) parameter to cachemgr.cgi.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"affected\", value:\"Squid versions prior to version 4.9.\");\n\n script_tag(name:\"solution\", value:\"Update to version 4.9 or later.\");\n\n script_xref(name:\"URL\", value:\"https://github.com/squid-cache/squid/pull/504\");\n script_xref(name:\"URL\", value:\"https://github.com/squid-cache/squid/pull/505\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!version = get_app_version(cpe: CPE, port: port))\n exit(0);\n\nif (version_is_less(version: version, test_version: \"4.9\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"4.9\");\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-05-18T15:38:38", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2020-05-14T00:00:00", "type": "openvas", "title": "Ubuntu: Security Advisory for squid (USN-4356-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12519", "CVE-2019-12521", "CVE-2019-18860", "CVE-2020-11945"], "modified": "2020-05-15T00:00:00", "id": "OPENVAS:1361412562310844426", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844426", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844426\");\n script_version(\"2020-05-15T04:25:55+0000\");\n script_cve_id(\"CVE-2019-12519\", \"CVE-2019-12521\", \"CVE-2019-18860\", \"CVE-2020-11945\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-05-15 04:25:55 +0000 (Fri, 15 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-05-14 03:00:26 +0000 (Thu, 14 May 2020)\");\n script_name(\"Ubuntu: Security Advisory for squid (USN-4356-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU19\\.10|UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS|UBUNTU20\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"4356-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2020-May/005428.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squid'\n package(s) announced via the USN-4356-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Jeriko One discovered that Squid incorrectly handled certain Edge Side\nIncludes (ESI) responses. A malicious remote server could cause Squid to\ncrash, possibly poison the cache, or possibly execute arbitrary code.\n(CVE-2019-12519, CVE-2019-12521)\n\nIt was discovered that Squid incorrectly handled the hostname parameter to\ncachemgr.cgi when certain browsers are used. A remote attacker could\npossibly use this issue to inject HTML or invalid characters in the\nhostname parameter. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS, and Ubuntu 19.10. (CVE-2019-18860)\n\nCl\u00e9ment Berthaux and Florian Guilbert discovered that Squid incorrectly\nhandled Digest Authentication nonce values. A remote attacker could\nuse this issue to replay nonce values, or possibly execute arbitrary code.\n(CVE-2020-11945)\");\n\n script_tag(name:\"affected\", value:\"'squid' package(s) on Ubuntu 20.04 LTS, Ubuntu 19.10, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU19.10\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"squid\", ver:\"4.8-1ubuntu2.3\", rls:\"UBUNTU19.10\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"squid\", ver:\"3.5.27-1ubuntu1.6\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"squid\", ver:\"3.5.12-1ubuntu7.11\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU20.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"squid\", ver:\"4.10-1ubuntu1.1\", rls:\"UBUNTU20.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-05-18T15:12:28", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2020-05-12T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for squid (openSUSE-SU-2020:0623-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12519", "CVE-2019-12528", "CVE-2019-12521", "CVE-2019-18860", "CVE-2020-11945", "CVE-2020-8517"], "modified": "2020-05-15T00:00:00", "id": "OPENVAS:1361412562310853156", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310853156", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.853156\");\n script_version(\"2020-05-15T04:25:55+0000\");\n script_cve_id(\"CVE-2019-12519\", \"CVE-2019-12521\", \"CVE-2019-12528\", \"CVE-2019-18860\", \"CVE-2020-11945\", \"CVE-2020-8517\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-05-15 04:25:55 +0000 (Fri, 15 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-05-12 03:03:48 +0000 (Tue, 12 May 2020)\");\n script_name(\"openSUSE: Security Advisory for squid (openSUSE-SU-2020:0623-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.1\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2020:0623-1\");\n script_xref(name:\"URL\", value:\"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squid'\n package(s) announced via the openSUSE-SU-2020:0623-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for squid to version 4.11 fixes the following issues:\n\n - CVE-2020-11945: Fixed a potential remote code execution vulnerability\n when using HTTP Digest Authentication (bsc#1170313).\n\n - CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can\n result in cache poisoning, remote execution, and denial of service\n attacks when processing ESI responses (bsc#1169659).\n\n - CVE-2020-8517: Fixed a possible denial of service caused by incorrect\n buffer management ext_lm_group_acl when processing NTLM Authentication\n credentials (bsc#1162691).\n\n - CVE-2019-12528: Fixed possible information disclosure when translating\n FTP server listings into HTTP responses (bsc#1162689).\n\n - CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi\n (bsc#1167373).\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.1:\n\n zypper in -t patch openSUSE-2020-623=1\");\n\n script_tag(name:\"affected\", value:\"'squid' package(s) on openSUSE Leap 15.1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"squid\", rpm:\"squid~4.11~lp151.2.15.2\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"squid-debuginfo\", rpm:\"squid-debuginfo~4.11~lp151.2.15.2\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"squid-debugsource\", rpm:\"squid-debugsource~4.11~lp151.2.15.2\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-07-21T20:05:15", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2020-07-17T00:00:00", "type": "openvas", "title": "Debian LTS: Security Advisory for squid3 (DLA-2278-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12519", "CVE-2019-12529", "CVE-2019-12528", "CVE-2019-18677", "CVE-2019-12523", "CVE-2019-13345", "CVE-2019-18678", "CVE-2019-12524", "CVE-2019-12520", "CVE-2019-12521", "CVE-2019-18676", "CVE-2019-18860", "CVE-2020-8450", "CVE-2018-19132", "CVE-2019-12525", "CVE-2020-11945", "CVE-2019-12526", "CVE-2019-18679", "CVE-2020-8449"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310892278", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892278", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892278\");\n script_version(\"2020-07-17T12:33:38+0000\");\n script_cve_id(\"CVE-2018-19132\", \"CVE-2019-12519\", \"CVE-2019-12520\", \"CVE-2019-12521\", \"CVE-2019-12523\", \"CVE-2019-12524\", \"CVE-2019-12525\", \"CVE-2019-12526\", \"CVE-2019-12528\", \"CVE-2019-12529\", \"CVE-2019-13345\", \"CVE-2019-18676\", \"CVE-2019-18677\", \"CVE-2019-18678\", \"CVE-2019-18679\", \"CVE-2019-18860\", \"CVE-2020-11945\", \"CVE-2020-8449\", \"CVE-2020-8450\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 12:33:38 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-07-17 12:33:38 +0000 (Fri, 17 Jul 2020)\");\n script_name(\"Debian LTS: Security Advisory for squid3 (DLA-2278-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DLA-2278-1\");\n script_xref(name:\"URL\", value:\"https://bugs.debian.org/950802\");\n script_xref(name:\"URL\", value:\"https://bugs.debian.org/931478\");\n script_xref(name:\"URL\", value:\"https://bugs.debian.org/950925\");\n script_xref(name:\"URL\", value:\"https://bugs.debian.org/912294\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squid3'\n package(s) announced via the DLA-2278-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was found that Squid, a high-performance proxy caching server for\nweb clients, has been affected by multiple security vulnerabilities.\nDue to incorrect input validation and URL request handling it was\npossible to bypass access restrictions for restricted HTTP servers\nand to cause a denial-of-service.\");\n\n script_tag(name:\"affected\", value:\"'squid3' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For Debian 9 stretch, these problems have been fixed in version\n3.5.23-5+deb9u2.\n\nWe recommend that you upgrade your squid3 packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"squid\", ver:\"3.5.23-5+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"squid-cgi\", ver:\"3.5.23-5+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"squid-common\", ver:\"3.5.23-5+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"squid-dbg\", ver:\"3.5.23-5+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"squid-purge\", ver:\"3.5.23-5+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"squid3\", ver:\"3.5.23-5+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"squidclient\", ver:\"3.5.23-5+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debiancve": [{"lastseen": "2023-12-03T15:24:43", "description": "Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2020-03-20T21:15:00", "type": "debiancve", "title": "CVE-2019-18860", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-18860"], "modified": "2020-03-20T21:15:00", "id": "DEBIANCVE:CVE-2019-18860", "href": "https://security-tracker.debian.org/tracker/CVE-2019-18860", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "redhatcve": [{"lastseen": "2023-12-04T11:44:25", "description": "A flaw was found in squid. Squid, when certain web browsers are used, mishandles HTML in the host parameter to cachemgr.cgi which could result in squid behaving in unsecure way.\n#### Mitigation\n\nThe cachemgr.cgi script is not used by default. If you&#x27;ve set this up manually and are worried about this issue, remove it from your server. \n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2020-03-25T16:01:25", "type": "redhatcve", "title": "CVE-2019-18860", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-18860"], "modified": "2023-04-06T06:20:16", "id": "RH:CVE-2019-18860", "href": "https://access.redhat.com/security/cve/cve-2019-18860", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "mscve": [{"lastseen": "2023-12-03T21:55:46", "description": "A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.\n\nExploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Excel. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.\n\nThe security update addresses the vulnerability by correcting how Microsoft Excel handles objects in memory.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-11T07:00:00", "type": "mscve", "title": "Microsoft Excel Remote Code Execution Vulnerability", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1504"], "modified": "2020-08-11T07:00:00", "id": "MS:CVE-2020-1504", "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1504", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2023-05-20T14:19:13", "description": "This update for squid fixes the following issues :\n\nCVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake (bsc#1173304).\n\nCVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-07-09T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : squid (SUSE-SU-2020:1803-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-18860", "CVE-2020-14059"], "modified": "2021-01-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:squid", "p-cpe:/a:novell:suse_linux:squid-debuginfo", "p-cpe:/a:novell:suse_linux:squid-debugsource", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2020-1803-1.NASL", "href": "https://www.tenable.com/plugins/nessus/138310", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2020:1803-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(138310);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\"CVE-2019-18860\", \"CVE-2020-14059\");\n\n script_name(english:\"SUSE SLES12 Security Update : squid (SUSE-SU-2020:1803-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for squid fixes the following issues :\n\nCVE-2020-14059: Fixed an issue where a client could potentially deny\nthe service of a server during TLS Handshake (bsc#1173304).\n\nCVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi\n(bsc#1167373).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1173304\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-18860/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-14059/\"\n );\n # https://www.suse.com/support/update/announcement/2020/suse-su-20201803-1\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8b3e59ca\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud Crowbar 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2020-1803=1\n\nSUSE OpenStack Cloud 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-8-2020-1803=1\n\nSUSE OpenStack Cloud 7 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-7-2020-1803=1\n\nSUSE Linux Enterprise Server for SAP 12-SP3 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP3-2020-1803=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP2-2020-1803=1\n\nSUSE Linux Enterprise Server 12-SP4 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-1803=1\n\nSUSE Linux Enterprise Server 12-SP3-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-2020-1803=1\n\nSUSE Linux Enterprise Server 12-SP3-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2020-1803=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-2020-1803=1\n\nSUSE Linux Enterprise Server 12-SP2-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2020-1803=1\n\nSUSE Enterprise Storage 5 :\n\nzypper in -t patch SUSE-Storage-5-2020-1803=1\n\nHPE Helion Openstack 8 :\n\nzypper in -t patch HPE-Helion-OpenStack-8-2020-1803=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-18860\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/03/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2|3|4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2/3/4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"squid-3.5.21-26.26.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"squid-debuginfo-3.5.21-26.26.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"squid-debugsource-3.5.21-26.26.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"squid-3.5.21-26.26.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"squid-debuginfo-3.5.21-26.26.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"squid-debugsource-3.5.21-26.26.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"squid-3.5.21-26.26.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"squid-debuginfo-3.5.21-26.26.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"squid-debugsource-3.5.21-26.26.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:05:11", "description": "Two security issues were discovered in the Squid proxy caching server, which could result in cache poisoning, request smuggling and incomplete validation of hostnames in cachemgr.cgi.", "cvss3": {}, "published": "2020-07-23T00:00:00", "type": "nessus", "title": "Debian DSA-4732-1 : squid - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-18860", "CVE-2020-15049"], "modified": "2022-05-13T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:squid", "cpe:/o:debian:debian_linux:10.0"], "id": "DEBIAN_DSA-4732.NASL", "href": "https://www.tenable.com/plugins/nessus/138860", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4732. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(138860);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/13\");\n\n script_cve_id(\"CVE-2019-18860\", \"CVE-2020-15049\");\n script_xref(name:\"DSA\", value:\"4732\");\n\n script_name(english:\"Debian DSA-4732-1 : squid - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Two security issues were discovered in the Squid proxy caching server,\nwhich could result in cache poisoning, request smuggling and\nincomplete validation of hostnames in cachemgr.cgi.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/squid\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/buster/squid\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2020/dsa-4732\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Upgrade the squid packages.\n\nFor the stable distribution (buster), these problems have been fixed\nin version 4.6-1+deb10u3.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-15049\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:10.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/03/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/07/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"10.0\", prefix:\"squid\", reference:\"4.6-1+deb10u3\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"squid-cgi\", reference:\"4.6-1+deb10u3\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"squid-common\", reference:\"4.6-1+deb10u3\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"squid-purge\", reference:\"4.6-1+deb10u3\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"squid3\", reference:\"4.6-1+deb10u3\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"squidclient\", reference:\"4.6-1+deb10u3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:24:59", "description": "According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.(CVE-2019-18860)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-02-04T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP5 : squid (EulerOS-SA-2021-1234)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-18860", "CVE-2020-15810"], "modified": "2022-05-10T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:squid", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2021-1234.NASL", "href": "https://www.tenable.com/plugins/nessus/146165", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146165);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/10\");\n\n script_cve_id(\"CVE-2019-18860\", \"CVE-2020-15810\");\n\n script_name(english:\"EulerOS 2.0 SP5 : squid (EulerOS-SA-2021-1234)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the squid package installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerabilities :\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the proxy cache and any\n downstream caches with content from an arbitrary\n source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace\n characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a\n conflicting length to be used from another\n Content-Length header) but relayed\n upstream.(CVE-2020-15810)\n\n - Squid before 4.9, when certain web browsers are used,\n mishandles HTML in the host (aka hostname) parameter to\n cachemgr.cgi.(CVE-2019-18860)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1234\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?71bce20a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-18860\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-15810\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(5)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"squid-4.8-3.h9.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"5\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-19T14:13:46", "description": "According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.(CVE-2019-18860)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing '+\\ '-' or an uncommon shell whitespace character prefix to the length field-value.(CVE-2020-15049)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-12-14T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2534)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-18860", "CVE-2020-15049", "CVE-2020-15810"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:squid", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-2534.NASL", "href": "https://www.tenable.com/plugins/nessus/144150", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(144150);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-18860\",\n \"CVE-2020-15049\",\n \"CVE-2020-15810\"\n );\n\n script_name(english:\"EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2534)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the squid package installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerabilities :\n\n - Squid before 4.9, when certain web browsers are used,\n mishandles HTML in the host (aka hostname) parameter to\n cachemgr.cgi.(CVE-2019-18860)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the proxy cache and any\n downstream caches with content from an arbitrary\n source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace\n characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a\n conflicting length to be used from another\n Content-Length header) but relayed\n upstream.(CVE-2020-15810)\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-2534\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7e6b5c34\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/12/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/12/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"squid-4.2-2.h11.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-21T15:26:37", "description": "Jeriko One discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A malicious remote server could cause Squid to crash, possibly poison the cache, or possibly execute arbitrary code. (CVE-2019-12519, CVE-2019-12521)\n\nIt was discovered that Squid incorrectly handled the hostname parameter to cachemgr.cgi when certain browsers are used. A remote attacker could possibly use this issue to inject HTML or invalid characters in the hostname parameter. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2019-18860)\n\nClement Berthaux and Florian Guilbert discovered that Squid incorrectly handled Digest Authentication nonce values. A remote attacker could use this issue to replay nonce values, or possibly execute arbitrary code. (CVE-2020-11945).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-05-14T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Squid vulnerabilities (USN-4356-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12519", "CVE-2019-12521", "CVE-2019-18860", "CVE-2020-11945"], "modified": "2023-10-20T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:squid-purge", "p-cpe:/a:canonical:ubuntu_linux:squid3", "p-cpe:/a:canonical:ubuntu_linux:squidclient", "cpe:/o:canonical:ubuntu_linux:16.04:-:lts", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:20.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:squid", "p-cpe:/a:canonical:ubuntu_linux:squid-cgi", "p-cpe:/a:canonical:ubuntu_linux:squid-common"], "id": "UBUNTU_USN-4356-1.NASL", "href": "https://www.tenable.com/plugins/nessus/136605", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4356-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(136605);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/20\");\n\n script_cve_id(\n \"CVE-2019-12519\",\n \"CVE-2019-12521\",\n \"CVE-2019-18860\",\n \"CVE-2020-11945\"\n );\n script_xref(name:\"USN\", value:\"4356-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Squid vulnerabilities (USN-4356-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"Jeriko One discovered that Squid incorrectly handled certain Edge Side\nIncludes (ESI) responses. A malicious remote server could cause Squid\nto crash, possibly poison the cache, or possibly execute arbitrary\ncode. (CVE-2019-12519, CVE-2019-12521)\n\nIt was discovered that Squid incorrectly handled the hostname\nparameter to cachemgr.cgi when certain browsers are used. A remote\nattacker could possibly use this issue to inject HTML or invalid\ncharacters in the hostname parameter. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2019-18860)\n\nClement Berthaux and Florian Guilbert discovered that Squid\nincorrectly handled Digest Authentication nonce values. A remote\nattacker could use this issue to replay nonce values, or possibly\nexecute arbitrary code. (CVE-2020-11945).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4356-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-11945\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/03/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/05/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squid-cgi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squid-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squid-purge\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squid3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squidclient\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:20.04:-:lts\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2020-2023 Canonical, Inc. / NASL script (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('debian_package.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/Ubuntu/release');\nif ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nos_release = chomp(os_release);\nif (! ('16.04' >< os_release || '18.04' >< os_release || '20.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04 / 18.04 / 20.04', 'Ubuntu ' + os_release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar pkgs = [\n {'osver': '16.04', 'pkgname': 'squid', 'pkgver': '3.5.12-1ubuntu7.11'},\n {'osver': '16.04', 'pkgname': 'squid-cgi', 'pkgver': '3.5.12-1ubuntu7.11'},\n {'osver': '16.04', 'pkgname': 'squid-common', 'pkgver': '3.5.12-1ubuntu7.11'},\n {'osver': '16.04', 'pkgname': 'squid-purge', 'pkgver': '3.5.12-1ubuntu7.11'},\n {'osver': '16.04', 'pkgname': 'squid3', 'pkgver': '3.5.12-1ubuntu7.11'},\n {'osver': '16.04', 'pkgname': 'squidclient', 'pkgver': '3.5.12-1ubuntu7.11'},\n {'osver': '18.04', 'pkgname': 'squid', 'pkgver': '3.5.27-1ubuntu1.6'},\n {'osver': '18.04', 'pkgname': 'squid-cgi', 'pkgver': '3.5.27-1ubuntu1.6'},\n {'osver': '18.04', 'pkgname': 'squid-common', 'pkgver': '3.5.27-1ubuntu1.6'},\n {'osver': '18.04', 'pkgname': 'squid-purge', 'pkgver': '3.5.27-1ubuntu1.6'},\n {'osver': '18.04', 'pkgname': 'squid3', 'pkgver': '3.5.27-1ubuntu1.6'},\n {'osver': '18.04', 'pkgname': 'squidclient', 'pkgver': '3.5.27-1ubuntu1.6'},\n {'osver': '20.04', 'pkgname': 'squid', 'pkgver': '4.10-1ubuntu1.1'},\n {'osver': '20.04', 'pkgname': 'squid-cgi', 'pkgver': '4.10-1ubuntu1.1'},\n {'osver': '20.04', 'pkgname': 'squid-common', 'pkgver': '4.10-1ubuntu1.1'},\n {'osver': '20.04', 'pkgname': 'squid-purge', 'pkgver': '4.10-1ubuntu1.1'},\n {'osver': '20.04', 'pkgname': 'squidclient', 'pkgver': '4.10-1ubuntu1.1'}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var osver = NULL;\n var pkgname = NULL;\n var pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'squid / squid-cgi / squid-common / squid-purge / squid3 / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:46:59", "description": "This update for squid to version 4.11 fixes the following issues :\n\n - CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).\n\n - CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).\n\n - CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).\n\n - CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).\n\n - CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "cvss3": {}, "published": "2020-05-11T00:00:00", "type": "nessus", "title": "openSUSE Security Update : squid (openSUSE-2020-623)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12519", "CVE-2019-12521", "CVE-2019-12528", "CVE-2019-18860", "CVE-2020-11945", "CVE-2020-8517"], "modified": "2020-05-13T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:squid", "p-cpe:/a:novell:opensuse:squid-debuginfo", "p-cpe:/a:novell:opensuse:squid-debugsource", "cpe:/o:novell:opensuse:15.1"], "id": "OPENSUSE-2020-623.NASL", "href": "https://www.tenable.com/plugins/nessus/136452", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2020-623.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(136452);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/05/13\");\n\n script_cve_id(\"CVE-2019-12519\", \"CVE-2019-12521\", \"CVE-2019-12528\", \"CVE-2019-18860\", \"CVE-2020-11945\", \"CVE-2020-8517\");\n\n script_name(english:\"openSUSE Security Update : squid (openSUSE-2020-623)\");\n script_summary(english:\"Check for the openSUSE-2020-623 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for squid to version 4.11 fixes the following issues :\n\n - CVE-2020-11945: Fixed a potential remote code execution\n vulnerability when using HTTP Digest Authentication\n (bsc#1170313).\n\n - CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer\n handling that can result in cache poisoning, remote\n execution, and denial of service attacks when processing\n ESI responses (bsc#1169659).\n\n - CVE-2020-8517: Fixed a possible denial of service caused\n by incorrect buffer management ext_lm_group_acl when\n processing NTLM Authentication credentials\n (bsc#1162691).\n\n - CVE-2019-12528: Fixed possible information disclosure\n when translating FTP server listings into HTTP responses\n (bsc#1162689).\n\n - CVE-2019-18860: Fixed handling of invalid domain names\n in cachemgr.cgi (bsc#1167373).\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1162689\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1162691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169659\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1170313\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squid packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:squid-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:squid-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/05/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"squid-4.11-lp151.2.15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"squid-debuginfo-4.11-lp151.2.15.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"squid-debugsource-4.11-lp151.2.15.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid / squid-debuginfo / squid-debugsource\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:44:58", "description": "This update for squid to version 4.11 fixes the following issues :\n\nCVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).\n\nCVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).\n\nCVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).\n\nCVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).\n\nCVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-04-29T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : squid (SUSE-SU-2020:1134-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12519", "CVE-2019-12521", "CVE-2019-12528", "CVE-2019-18860", "CVE-2020-11945", "CVE-2020-8517"], "modified": "2020-05-04T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:squid", "p-cpe:/a:novell:suse_linux:squid-debuginfo", "p-cpe:/a:novell:suse_linux:squid-debugsource", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2020-1134-1.NASL", "href": "https://www.tenable.com/plugins/nessus/136081", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2020:1134-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(136081);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/05/04\");\n\n script_cve_id(\"CVE-2019-12519\", \"CVE-2019-12521\", \"CVE-2019-12528\", \"CVE-2019-18860\", \"CVE-2020-11945\", \"CVE-2020-8517\");\n\n script_name(english:\"SUSE SLES12 Security Update : squid (SUSE-SU-2020:1134-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for squid to version 4.11 fixes the following issues :\n\nCVE-2020-11945: Fixed a potential remote code execution vulnerability\nwhen using HTTP Digest Authentication (bsc#1170313).\n\nCVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that\ncan result in cache poisoning, remote execution, and denial of service\nattacks when processing ESI responses (bsc#1169659).\n\nCVE-2020-8517: Fixed a possible denial of service caused by incorrect\nbuffer management ext_lm_group_acl when processing NTLM Authentication\ncredentials (bsc#1162691).\n\nCVE-2019-12528: Fixed possible information disclosure when translating\nFTP server listings into HTTP responses (bsc#1162689).\n\nCVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi\n(bsc#1167373).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1162689\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1162691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169659\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1170313\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-12519/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-12521/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-12528/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-18860/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-11945/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-8517/\"\n );\n # https://www.suse.com/support/update/announcement/2020/suse-su-20201134-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?36ea22db\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-SP5 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-1134=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(5)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP5\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"squid-4.11-4.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"squid-debuginfo-4.11-4.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"squid-debugsource-4.11-4.9.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:45:57", "description": "This update for squid to version 4.11 fixes the following issues :\n\nCVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).\n\nCVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).\n\nCVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).\n\nCVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).\n\nCVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-05-01T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : squid (SUSE-SU-2020:1156-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12519", "CVE-2019-12521", "CVE-2019-12528", "CVE-2019-18860", "CVE-2020-11945", "CVE-2020-8517"], "modified": "2020-05-07T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:squid", "p-cpe:/a:novell:suse_linux:squid-debuginfo", "p-cpe:/a:novell:suse_linux:squid-debugsource", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2020-1156-1.NASL", "href": "https://www.tenable.com/plugins/nessus/136279", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2020:1156-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(136279);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/05/07\");\n\n script_cve_id(\"CVE-2019-12519\", \"CVE-2019-12521\", \"CVE-2019-12528\", \"CVE-2019-18860\", \"CVE-2020-11945\", \"CVE-2020-8517\");\n\n script_name(english:\"SUSE SLES15 Security Update : squid (SUSE-SU-2020:1156-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for squid to version 4.11 fixes the following issues :\n\nCVE-2020-11945: Fixed a potential remote code execution vulnerability\nwhen using HTTP Digest Authentication (bsc#1170313).\n\nCVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that\ncan result in cache poisoning, remote execution, and denial of service\nattacks when processing ESI responses (bsc#1169659).\n\nCVE-2020-8517: Fixed a possible denial of service caused by incorrect\nbuffer management ext_lm_group_acl when processing NTLM Authentication\ncredentials (bsc#1162691).\n\nCVE-2019-12528: Fixed possible information disclosure when translating\nFTP server listings into HTTP responses (bsc#1162689).\n\nCVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi\n(bsc#1167373).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1162689\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1162691\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169659\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1170313\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-12519/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-12521/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-12528/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-18860/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-11945/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-8517/\"\n );\n # https://www.suse.com/support/update/announcement/2020/suse-su-20201156-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2acfa33b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server for SAP 15 :\n\nzypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-1156=1\n\nSUSE Linux Enterprise Server 15-LTSS :\n\nzypper in -t patch SUSE-SLE-Product-SLES-15-2020-1156=1\n\nSUSE Linux Enterprise Module for Server Applications 15-SP2 :\n\nzypper in -t patch\nSUSE-SLE-Module-Server-Applications-15-SP2-2020-1156=1\n\nSUSE Linux Enterprise Module for Server Applications 15-SP1 :\n\nzypper in -t patch\nSUSE-SLE-Module-Server-Applications-15-SP1-2020-1156=1\n\nSUSE Linux Enterprise High Performance Computing 15-LTSS :\n\nzypper in -t patch SUSE-SLE-Product-HPC-15-2020-1156=1\n\nSUSE Linux Enterprise High Performance Computing 15-ESPOS :\n\nzypper in -t patch SUSE-SLE-Product-HPC-15-2020-1156=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/05/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0|1|2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0/1/2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"squid-4.11-5.17.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"squid-debuginfo-4.11-5.17.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"squid-debugsource-4.11-5.17.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"squid-4.11-5.17.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"squid-debuginfo-4.11-5.17.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"squid-debugsource-4.11-5.17.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"squid-4.11-5.17.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"squid-debuginfo-4.11-5.17.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"squid-debugsource-4.11-5.17.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-15T17:43:28", "description": "The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2318 advisory.\n\n - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\n - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.\n uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. (CVE-2019-12529)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.\n (CVE-2019-18677)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. (CVE-2019-18678)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. (CVE-2019-18860)\n\n - Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody. (CVE-2021-28116)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2023-10-26T00:00:00", "type": "nessus", "title": "Amazon Linux 2 : squid (ALAS-2023-2318)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12524", "CVE-2019-12529", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18860", "CVE-2021-28116", "CVE-2023-46847"], "modified": "2023-11-08T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:squid", "p-cpe:/a:amazon:linux:squid-debuginfo", "p-cpe:/a:amazon:linux:squid-migration-script", "p-cpe:/a:amazon:linux:squid-sysvinit", "cpe:/o:amazon:linux:2"], "id": "AL2_ALAS-2023-2318.NASL", "href": "https://www.tenable.com/plugins/nessus/183925", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux 2 Security Advisory ALAS-2023-2318.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(183925);\n script_version(\"1.1\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/11/08\");\n\n script_cve_id(\n \"CVE-2019-12524\",\n \"CVE-2019-12529\",\n \"CVE-2019-18677\",\n \"CVE-2019-18678\",\n \"CVE-2019-18860\",\n \"CVE-2021-28116\",\n \"CVE-2023-46847\"\n );\n\n script_name(english:\"Amazon Linux 2 : squid (ALAS-2023-2318)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Amazon Linux 2 host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple\nvulnerabilities as referenced in the ALAS2-2023-2318 advisory.\n\n - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to\n see if the request should be denied. Squid by default comes with rules to block access to the Cache\n Manager, which serves detailed server information meant for the maintainer. This rule is implemented via\n url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to\n encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\n - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When\n Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.\n uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The\n length is then used to start decoding the string. There are no checks to ensure that the length it\n calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An\n attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the\n display of usernames on error pages. (CVE-2019-12529)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because\n the appended characters do not properly interact with hostname length restrictions). Due to incorrect\n message processing, it can inappropriately redirect traffic to origins it should not be delivered to.\n (CVE-2019-18677)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests\n through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The\n resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content\n at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no\n effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing\n whitespace between a header name and a colon. (CVE-2019-18678)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter\n to cachemgr.cgi. (CVE-2019-18860)\n\n - Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of\n an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code\n execution as nobody. (CVE-2021-28116)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/AL2/ALAS-2023-2318.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/faqs.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/cve/html/CVE-2019-12524.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/cve/html/CVE-2019-12529.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/cve/html/CVE-2019-18677.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/cve/html/CVE-2019-18678.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/cve/html/CVE-2019-18860.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/cve/html/CVE-2021-28116.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/cve/html/CVE-2023-46847.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Run 'yum update squid' to update your system.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-12524\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/07/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2023/10/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/10/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:squid-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:squid-migration-script\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:squid-sysvinit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux:2\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar alas_release = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nvar os_ver = pregmatch(pattern: \"^AL(A|\\d+|-\\d+)\", string:alas_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"2\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux 2\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar pkgs = [\n {'reference':'squid-3.5.20-17.amzn2.7.10', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-3.5.20-17.amzn2.7.10', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-3.5.20-17.amzn2.7.10', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-debuginfo-3.5.20-17.amzn2.7.10', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-debuginfo-3.5.20-17.amzn2.7.10', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-debuginfo-3.5.20-17.amzn2.7.10', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-migration-script-3.5.20-17.amzn2.7.10', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-migration-script-3.5.20-17.amzn2.7.10', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-migration-script-3.5.20-17.amzn2.7.10', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-sysvinit-3.5.20-17.amzn2.7.10', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-sysvinit-3.5.20-17.amzn2.7.10', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-sysvinit-3.5.20-17.amzn2.7.10', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid / squid-debuginfo / squid-migration-script / etc\");\n}", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T14:59:11", "description": "The Microsoft Excel Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the users computer or data. (CVE-2020-1497)\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2020-1494, CVE-2020-1495, CVE-2020-1496, CVE-2020-1498, CVE-2020-1504)", "cvss3": {}, "published": "2022-06-10T00:00:00", "type": "nessus", "title": "Security Updates for Microsoft Excel Products C2R (August 2020)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1497", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2023-10-25T00:00:00", "cpe": ["cpe:/a:microsoft:excel"], "id": "SMB_NT_MS20_AUG_EXCEL_C2R.NASL", "href": "https://www.tenable.com/plugins/nessus/162053", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(162053);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/25\");\n\n script_cve_id(\n \"CVE-2020-1494\",\n \"CVE-2020-1495\",\n \"CVE-2020-1496\",\n \"CVE-2020-1497\",\n \"CVE-2020-1498\",\n \"CVE-2020-1504\"\n );\n script_xref(name:\"IAVA\", value:\"2020-A-0365-S\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2020-0101\");\n\n script_name(english:\"Security Updates for Microsoft Excel Products C2R (August 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Excel Products are affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Excel Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft Excel improperly discloses the contents of its\n memory. An attacker who exploited the vulnerability\n could use the information to compromise the users\n computer or data. (CVE-2020-1497)\n\n - A remote code execution vulnerability exists in\n Microsoft Excel software when the software fails to\n properly handle objects in memory. An attacker who\n successfully exploited the vulnerability could run\n arbitrary code in the context of the current user. If\n the current user is logged on with administrative user\n rights, an attacker could take control of the affected\n system. An attacker could then install programs; view,\n change, or delete data; or create new accounts with full\n user rights. (CVE-2020-1494, CVE-2020-1495,\n CVE-2020-1496, CVE-2020-1498, CVE-2020-1504)\");\n # https://docs.microsoft.com/en-us/officeupdates/update-history-microsoft365-apps-by-date\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fd4508ff\");\n script_set_attribute(attribute:\"solution\", value:\n\"For Office 365, Office 2016 C2R, or Office 2019, ensure automatic\nupdates are enabled or open any office app and manually perform an\nupdate.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-1504\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/08/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/08/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/06/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:excel\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"office_installed.nasl\", \"microsoft_office_compatibility_pack_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('vcf_extras_office.inc');\n\nvar bulletin = 'MS20-08';\n\nvar constraints = [\n {'fixed_version':'16.0.11328.20644','channel': 'Deferred'},\n {'fixed_version':'16.0.11929.20934','channel': 'Deferred','channel_version': '1908'},\n {'fixed_version':'16.0.13001.20520','channel': 'Enterprise Deferred','channel_version': '2006'},\n {'fixed_version':'16.0.12827.20656','channel': 'Enterprise Deferred'},\n {'fixed_version':'16.0.12527.20988','channel': 'Microsoft 365 Apps on Windows 7'},\n {'fixed_version':'16.0.12527.20988','channel': 'First Release for Deferred'},\n {'fixed_version':'16.0.13029.20344','channel': '2016 Retail'},\n {'fixed_version':'16.0.13029.20344','channel': 'Current'},\n {'fixed_version':'16.0.12527.20988','channel': '2019 Retail'},\n {'fixed_version':'16.0.12527.20988','channel': '2019 Retail','channel_version': '2002'},\n {'fixed_version':'16.0.13029.20344','channel': '2019 Retail','channel_version': '2004'},\n {'fixed_version':'16.0.10364.20059','channel': '2019 Volume'}\n];\n\nvcf::microsoft::office_product::check_version_and_report(\n constraints:constraints,\n severity:SECURITY_HOLE,\n bulletin:bulletin,\n subproduct:'Excel'\n);", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-20T14:52:06", "description": "The Microsoft Excel Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the users computer or data. (CVE-2020-1497)\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2020-1494, CVE-2020-1495, CVE-2020-1496, CVE-2020-1498, CVE-2020-1504)", "cvss3": {}, "published": "2020-08-11T00:00:00", "type": "nessus", "title": "Security Updates for Microsoft Excel Products (August 2020)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1497", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/a:microsoft:excel"], "id": "SMB_NT_MS20_AUG_EXCEL.NASL", "href": "https://www.tenable.com/plugins/nessus/139497", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(139497);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-1494\",\n \"CVE-2020-1495\",\n \"CVE-2020-1496\",\n \"CVE-2020-1497\",\n \"CVE-2020-1498\",\n \"CVE-2020-1504\"\n );\n script_xref(name:\"MSKB\", value:\"4484465\");\n script_xref(name:\"MSKB\", value:\"4484449\");\n script_xref(name:\"MSKB\", value:\"4484461\");\n script_xref(name:\"MSFT\", value:\"MS20-4484465\");\n script_xref(name:\"MSFT\", value:\"MS20-4484449\");\n script_xref(name:\"MSFT\", value:\"MS20-4484461\");\n script_xref(name:\"IAVA\", value:\"2020-A-0365-S\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2020-0101\");\n\n script_name(english:\"Security Updates for Microsoft Excel Products (August 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Excel Products are affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Excel Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft Excel improperly discloses the contents of its\n memory. An attacker who exploited the vulnerability\n could use the information to compromise the users\n computer or data. (CVE-2020-1497)\n\n - A remote code execution vulnerability exists in\n Microsoft Excel software when the software fails to\n properly handle objects in memory. An attacker who\n successfully exploited the vulnerability could run\n arbitrary code in the context of the current user. If\n the current user is logged on with administrative user\n rights, an attacker could take control of the affected\n system. An attacker could then install programs; view,\n change, or delete data; or create new accounts with full\n user rights. (CVE-2020-1494, CVE-2020-1495,\n CVE-2020-1496, CVE-2020-1498, CVE-2020-1504)\");\n # https://support.microsoft.com/en-us/help/4484465/security-update-for-excel-2016-august-11-2020\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2dc68596\");\n # https://support.microsoft.com/en-us/help/4484449/security-update-for-excel-2013-august-11-2020\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?daa95a32\");\n # https://support.microsoft.com/en-us/help/4484461/security-update-for-excel-2010-august-11-2020\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e609c2e0\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released the following security updates to address this issue: \n -KB4484465\n -KB4484449\n -KB4484461\n\nFor Office 365, Office 2016 C2R, or Office 2019, ensure automatic\nupdates are enabled or open any office app and manually perform an\nupdate.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-1494\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/08/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/08/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/08/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:excel\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"office_installed.nasl\", \"microsoft_office_compatibility_pack_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('install_func.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-08';\n\nkbs = make_list(\n '4484461',\n '4484449',\n '4484465'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\nport = kb_smb_transport();\n\nchecks = make_array(\n '14.0', make_array('sp', 2, 'version', '14.0.7256.5000', 'kb', '4484461'),\n '15.0', make_array('sp', 1, 'version', '15.0.5267.1000', 'kb', '4484449'),\n '16.0', make_nested_list(\n make_array('sp', 0, 'version', '16.0.5044.1000', 'channel', 'MSI', 'kb', '4484465')\n )\n);\n\nif (hotfix_check_office_product(product:'Excel', checks:checks, bulletin:bulletin))\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-09T14:21:54", "description": "The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4743 advisory.\n\n - squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n - squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n - squid: Improper input validation in URI processor (CVE-2019-12523)\n\n - squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n - squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n - squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n - squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n - squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n - squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n - squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n - squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n - squid: DoS in TLS handshake (CVE-2020-14058)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-02-01T00:00:00", "type": "nessus", "title": "CentOS 8 : squid:4 (CESA-2020:4743)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2023-02-08T00:00:00", "cpe": ["cpe:/o:centos:centos:8", "p-cpe:/a:centos:centos:libecap", "p-cpe:/a:centos:centos:libecap-devel", "p-cpe:/a:centos:centos:squid"], "id": "CENTOS8_RHSA-2020-4743.NASL", "href": "https://www.tenable.com/plugins/nessus/145969", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# Red Hat Security Advisory RHSA-2020:4743. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145969);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/08\");\n\n script_cve_id(\n \"CVE-2019-12520\",\n \"CVE-2019-12521\",\n \"CVE-2019-12523\",\n \"CVE-2019-12524\",\n \"CVE-2019-12526\",\n \"CVE-2019-12528\",\n \"CVE-2019-12529\",\n \"CVE-2019-12854\",\n \"CVE-2019-18676\",\n \"CVE-2019-18677\",\n \"CVE-2019-18678\",\n \"CVE-2019-18679\",\n \"CVE-2019-18860\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-14058\",\n \"CVE-2020-15049\",\n \"CVE-2020-24606\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4743\");\n\n script_name(english:\"CentOS 8 : squid:4 (CESA-2020:4743)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2020:4743 advisory.\n\n - squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n - squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n - squid: Improper input validation in URI processor (CVE-2019-12523)\n\n - squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n - squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n - squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n - squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n - squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n - squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n - squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n - squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour\n (CVE-2019-18860)\n\n - squid: DoS in TLS handshake (CVE-2020-14058)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:4743\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libecap, libecap-devel and / or squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-12526\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/07/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libecap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libecap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:squid\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/CentOS/release');\nif (isnull(os_release) || 'CentOS' >!< os_release) audit(AUDIT_OS_NOT, 'CentOS');\nvar os_ver = pregmatch(pattern: \"CentOS(?: Stream)?(?: Linux)? release ([0-9]+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nos_ver = os_ver[1];\nif ('CentOS Stream' >< os_release) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS Stream ' + os_ver);\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\nvar module_ver = get_kb_item('Host/RedHat/appstream/squid');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\nif ('4' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module squid:' + module_ver);\n\nvar appstreams = {\n 'squid:4': [\n {'reference':'libecap-1.0.1-2.module_el8.1.0+197+0c39cdc8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-1.0.1-2.module_el8.1.0+197+0c39cdc8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module_el8.1.0+197+0c39cdc8', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module_el8.1.0+197+0c39cdc8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-4.11-3.module_el8.3.0+558+7bf80f5f', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'},\n {'reference':'squid-4.11-3.module_el8.3.0+558+7bf80f5f', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'}\n ]\n};\n\nvar flag = 0;\nappstreams_found = 0;\nforeach module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach package_array ( appstreams[module] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'CentOS-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && _release) {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libecap / libecap-devel / squid');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-12T13:33:55", "description": "The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4743 advisory.\n\n - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.\n If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)\n\n - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.\n (CVE-2019-12521)\n\n - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost. (CVE-2019-12523)\n\n - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\n - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap. (CVE-2019-12526)\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non- Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.\n uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. (CVE-2019-12529)\n\n - Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it. (CVE-2019-12854)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme. (CVE-2019-18676)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.\n (CVE-2019-18677)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. (CVE-2019-18678)\n\n - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.\n (CVE-2019-18679)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. (CVE-2019-18860)\n\n - An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string. (CVE-2020-14058)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix to the length field-value. (CVE-2020-15049)\n\n - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2023-11-06T00:00:00", "type": "nessus", "title": "Rocky Linux 8 : squid:4 (RLSA-2020:4743)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2023-11-06T00:00:00", "cpe": ["p-cpe:/a:rocky:linux:libecap", "p-cpe:/a:rocky:linux:libecap-debuginfo", "p-cpe:/a:rocky:linux:libecap-debugsource", "p-cpe:/a:rocky:linux:libecap-devel", "cpe:/o:rocky:linux:8"], "id": "ROCKY_LINUX_RLSA-2020-4743.NASL", "href": "https://www.tenable.com/plugins/nessus/184691", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# Rocky Linux Security Advisory RLSA-2020:4743.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(184691);\n script_version(\"1.0\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/11/06\");\n\n script_cve_id(\n \"CVE-2019-12520\",\n \"CVE-2019-12521\",\n \"CVE-2019-12523\",\n \"CVE-2019-12524\",\n \"CVE-2019-12526\",\n \"CVE-2019-12528\",\n \"CVE-2019-12529\",\n \"CVE-2019-12854\",\n \"CVE-2019-18676\",\n \"CVE-2019-18677\",\n \"CVE-2019-18678\",\n \"CVE-2019-18679\",\n \"CVE-2019-18860\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-14058\",\n \"CVE-2020-15049\",\n \"CVE-2020-24606\"\n );\n script_xref(name:\"RLSA\", value:\"2020:4743\");\n\n script_name(english:\"Rocky Linux 8 : squid:4 (RLSA-2020:4743)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Rocky Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nRLSA-2020:4743 advisory.\n\n - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to\n see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.\n If found, it servers the request. The absolute URL can include the decoded UserInfo (username and\n password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to\n provide a username that has special characters to delimit the domain, and treat the rest of the URL as a\n path or query string. An attacker could first make a request to their domain using an encoded username,\n then when a request for the target domain comes in that decodes to the exact URL, it will serve the\n attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows\n an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)\n\n - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in\n ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is\n parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this\n buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same\n structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.\n (CVE-2019-12521)\n\n - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is\n made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This\n causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker\n can connect to HTTP servers that only listen on localhost. (CVE-2019-12523)\n\n - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to\n see if the request should be denied. Squid by default comes with rules to block access to the Cache\n Manager, which serves detailed server information meant for the maintainer. This rule is implemented via\n url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to\n encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\n - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based\n buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to\n ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in\n the heap. (CVE-2019-12526)\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of\n sensitive information from heap memory, such as information associated with other users' sessions or non-\n Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When\n Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.\n uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The\n length is then used to start decoding the string. There are no checks to ensure that the length it\n calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An\n attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the\n display of usernames on error pages. (CVE-2019-12529)\n\n - Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On\n systems with memory access protections, this can cause the CGI process to terminate unexpectedly,\n resulting in a denial of service for all clients using it. (CVE-2019-12854)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a\n heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity\n is high due to this vulnerability occurring before normal security checks; any remote client that can\n reach the proxy port can trivially perform the attack via a crafted URI scheme. (CVE-2019-18676)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because\n the appended characters do not properly interact with hostname length restrictions). Due to incorrect\n message processing, it can inappropriately redirect traffic to origins it should not be delivered to.\n (CVE-2019-18677)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests\n through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The\n resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content\n at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no\n effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing\n whitespace between a header name and a colon. (CVE-2019-18678)\n\n - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is\n vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the\n raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR\n protections and may aid attackers isolating memory areas to target for remote code execution attacks.\n (CVE-2019-18679)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter\n to cachemgr.cgi. (CVE-2019-18860)\n\n - An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous\n function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when\n opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized\n error values are mapped to NULL, but later code expects that each error value is mapped to a valid error\n string. (CVE-2020-14058)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A\n Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP\n request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix\n to the length field-value. (CVE-2020-15049)\n\n - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all\n available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when\n cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply()\n livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted\n HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can\n cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.rockylinux.org/RLSA-2020:4743\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1730523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1730528\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1770349\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1770356\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1770360\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1770365\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1770371\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1770375\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1798534\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1798540\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1798552\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1817121\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1827558\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1827562\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1827570\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1852550\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1852554\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1871705\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-12526\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/07/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/11/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:libecap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:libecap-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:libecap-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:libecap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:rocky:linux:8\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Rocky Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RockyLinux/release\", \"Host/RockyLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RockyLinux/release');\nif (isnull(os_release) || 'Rocky Linux' >!< os_release) audit(AUDIT_OS_NOT, 'Rocky Linux');\nvar os_ver = pregmatch(pattern: \"Rocky(?: Linux)? release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Rocky Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Rocky Linux 8.x', 'Rocky Linux ' + os_ver);\n\nif (!get_kb_item('Host/RockyLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Rocky Linux', cpu);\n\nvar module_ver = get_kb_item('Host/RockyLinux/appstream/squid');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\nif ('4' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module squid:' + module_ver);\n\nvar appstreams = {\n 'squid:4': [\n {'reference':'libecap-1.0.1-2.module+el8.4.0+404+316a0dc5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-1.0.1-2.module+el8.4.0+404+316a0dc5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-debuginfo-1.0.1-2.module+el8.4.0+404+316a0dc5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-debuginfo-1.0.1-2.module+el8.4.0+404+316a0dc5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-debugsource-1.0.1-2.module+el8.4.0+404+316a0dc5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-debugsource-1.0.1-2.module+el8.4.0+404+316a0dc5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module+el8.4.0+404+316a0dc5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module+el8.4.0+404+316a0dc5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n};\n\nvar flag = 0;\nvar appstreams_found = 0;\nforeach var module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RockyLinux/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach var package_array ( appstreams[module] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'Rocky-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libecap / libecap-debuginfo / libecap-debugsource / libecap-devel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-02T15:37:07", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4743 advisory.\n\n - squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n - squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n - squid: Improper input validation in URI processor (CVE-2019-12523)\n\n - squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n - squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n - squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n - squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n - squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n - squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n - squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n - squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n - squid: DoS in TLS handshake (CVE-2020-14058)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2020-11-04T00:00:00", "type": "nessus", "title": "RHEL 8 : squid:4 (RHSA-2020:4743)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.4", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.4", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.4", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.4", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:libecap", "p-cpe:/a:redhat:enterprise_linux:libecap-devel", "p-cpe:/a:redhat:enterprise_linux:squid"], "id": "REDHAT-RHSA-2020-4743.NASL", "href": "https://www.tenable.com/plugins/nessus/142412", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:4743. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142412);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\n \"CVE-2019-12520\",\n \"CVE-2019-12521\",\n \"CVE-2019-12523\",\n \"CVE-2019-12524\",\n \"CVE-2019-12526\",\n \"CVE-2019-12528\",\n \"CVE-2019-12529\",\n \"CVE-2019-12854\",\n \"CVE-2019-18676\",\n \"CVE-2019-18677\",\n \"CVE-2019-18678\",\n \"CVE-2019-18679\",\n \"CVE-2019-18860\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-14058\",\n \"CVE-2020-15049\",\n \"CVE-2020-24606\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4743\");\n\n script_name(english:\"RHEL 8 : squid:4 (RHSA-2020:4743)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:4743 advisory.\n\n - squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n - squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n - squid: Improper input validation in URI processor (CVE-2019-12523)\n\n - squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n - squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n - squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n - squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n - squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n - squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n - squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n - squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour\n (CVE-2019-18860)\n\n - squid: DoS in TLS handshake (CVE-2020-14058)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12520\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12524\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12526\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12528\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12529\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12854\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18676\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18677\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18678\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18679\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18860\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-8449\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-8450\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14058\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-15049\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-24606\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:4743\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1730523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1730528\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770349\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770356\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770360\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770365\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770371\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770375\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1798534\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1798540\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1798552\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1817121\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1827558\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1827562\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1827570\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1852550\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1852554\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1871705\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libecap, libecap-devel and / or squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-12526\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 79, 119, 122, 200, 400, 444, 676);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/07/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libecap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libecap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:squid\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar appstreams = {\n 'squid:4': [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.4/x86_64/appstream/debug',\n 'content/aus/rhel8/8.4/x86_64/appstream/os',\n 'content/aus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.4/x86_64/baseos/debug',\n 'content/aus/rhel8/8.4/x86_64/baseos/os',\n 'content/aus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/appstream/debug',\n 'content/e4s/rhel8/8.4/aarch64/appstream/os',\n 'content/e4s/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/baseos/debug',\n 'content/e4s/rhel8/8.4/aarch64/baseos/os',\n 'content/e4s/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/appstream/debug',\n 'content/e4s/rhel8/8.4/s390x/appstream/os',\n 'content/e4s/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/baseos/debug',\n 'content/e4s/rhel8/8.4/s390x/baseos/os',\n 'content/e4s/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.4/x86_64/appstream/os',\n 'content/e4s/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.4/x86_64/baseos/os',\n 'content/e4s/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/nfv/debug',\n 'content/e4s/rhel8/8.4/x86_64/nfv/os',\n 'content/e4s/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap/os',\n 'content/e4s/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/appstream/debug',\n 'content/eus/rhel8/8.4/aarch64/appstream/os',\n 'content/eus/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/baseos/debug',\n 'content/eus/rhel8/8.4/aarch64/baseos/os',\n 'content/eus/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.4/aarch64/highavailability/os',\n 'content/eus/rhel8/8.4/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.4/aarch64/supplementary/os',\n 'content/eus/rhel8/8.4/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.4/ppc64le/appstream/os',\n 'content/eus/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.4/ppc64le/baseos/os',\n 'content/eus/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap/os',\n 'content/eus/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/appstream/debug',\n 'content/eus/rhel8/8.4/s390x/appstream/os',\n 'content/eus/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/baseos/debug',\n 'content/eus/rhel8/8.4/s390x/baseos/os',\n 'content/eus/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/highavailability/debug',\n 'content/eus/rhel8/8.4/s390x/highavailability/os',\n 'content/eus/rhel8/8.4/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/sap/debug',\n 'content/eus/rhel8/8.4/s390x/sap/os',\n 'content/eus/rhel8/8.4/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/supplementary/debug',\n 'content/eus/rhel8/8.4/s390x/supplementary/os',\n 'content/eus/rhel8/8.4/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/appstream/debug',\n 'content/eus/rhel8/8.4/x86_64/appstream/os',\n 'content/eus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/baseos/debug',\n 'content/eus/rhel8/8.4/x86_64/baseos/os',\n 'content/eus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.4/x86_64/highavailability/os',\n 'content/eus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap/debug',\n 'content/eus/rhel8/8.4/x86_64/sap/os',\n 'content/eus/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.4/x86_64/supplementary/os',\n 'content/eus/rhel8/8.4/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/appstream/debug',\n 'content/tus/rhel8/8.4/x86_64/appstream/os',\n 'content/tus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/baseos/debug',\n 'content/tus/rhel8/8.4/x86_64/baseos/os',\n 'content/tus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.4/x86_64/highavailability/os',\n 'content/tus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/nfv/debug',\n 'content/tus/rhel8/8.4/x86_64/nfv/os',\n 'content/tus/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/rt/debug',\n 'content/tus/rhel8/8.4/x86_64/rt/os',\n 'content/tus/rhel8/8.4/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'libecap-1.0.1-2.module+el8.1.0+4044+36416a77', 'sp':'4', 'release':'8', 'el_string':'el8.1.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77', 'sp':'4', 'release':'8', 'el_string':'el8.1.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-4.11-3.module+el8.3.0+7851+7808b5f9', 'sp':'4', 'release':'8', 'el_string':'el8.3.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'libecap-1.0.1-2.module+el8.1.0+4044+36416a77', 'sp':'6', 'release':'8', 'el_string':'el8.1.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77', 'sp':'6', 'release':'8', 'el_string':'el8.1.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-4.11-3.module+el8.3.0+7851+7808b5f9', 'sp':'6', 'release':'8', 'el_string':'el8.3.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'libecap-1.0.1-2.module+el8.1.0+4044+36416a77', 'release':'8', 'el_string':'el8.1.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77', 'release':'8', 'el_string':'el8.1.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-4.11-3.module+el8.3.0+7851+7808b5f9', 'release':'8', 'el_string':'el8.3.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'}\n ]\n }\n ]\n};\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:appstreams, appstreams:TRUE);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar module_ver = get_kb_item('Host/RedHat/appstream/squid');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\nif ('4' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module squid:' + module_ver);\n\nvar flag = 0;\nvar appstreams_found = 0;\nforeach var module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach var module_array ( appstreams[module] ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(module_array['repo_relative_urls'])) repo_relative_urls = module_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var package_array ( module_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp']) && !enterprise_linux_flag) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libecap / libecap-devel / squid');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-10T16:45:58", "description": "The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4743 advisory.\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non- Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix to the length field-value. (CVE-2020-15049)\n\n - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.\n (CVE-2019-12521)\n\n - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost. (CVE-2019-12523)\n\n - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\n - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap. (CVE-2019-12526)\n\n - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.\n uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. (CVE-2019-12529)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. (CVE-2019-18860)\n\n - An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string. (CVE-2020-14058)\n\n - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.\n If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)\n\n - Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it. (CVE-2019-12854)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme. (CVE-2019-18676)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.\n (CVE-2019-18677)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. (CVE-2019-18678)\n\n - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.\n (CVE-2019-18679)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2023-09-07T00:00:00", "type": "nessus", "title": "Oracle Linux 8 : squid:4 (ELSA-2020-4743)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2023-09-07T00:00:00", "cpe": ["cpe:/o:oracle:linux:8", "p-cpe:/a:oracle:linux:libecap", "p-cpe:/a:oracle:linux:libecap-devel", "p-cpe:/a:oracle:linux:squid"], "id": "ORACLELINUX_ELSA-2020-4743.NASL", "href": "https://www.tenable.com/plugins/nessus/180917", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2020-4743.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(180917);\n script_version(\"1.0\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/09/07\");\n\n script_cve_id(\n \"CVE-2019-12520\",\n \"CVE-2019-12521\",\n \"CVE-2019-12523\",\n \"CVE-2019-12524\",\n \"CVE-2019-12526\",\n \"CVE-2019-12528\",\n \"CVE-2019-12529\",\n \"CVE-2019-12854\",\n \"CVE-2019-18676\",\n \"CVE-2019-18677\",\n \"CVE-2019-18678\",\n \"CVE-2019-18679\",\n \"CVE-2019-18860\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-14058\",\n \"CVE-2020-15049\",\n \"CVE-2020-24606\"\n );\n\n script_name(english:\"Oracle Linux 8 : squid:4 (ELSA-2020-4743)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2020-4743 advisory.\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of\n sensitive information from heap memory, such as information associated with other users' sessions or non-\n Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can\n cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A\n Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP\n request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix\n to the length field-value. (CVE-2020-15049)\n\n - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all\n available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when\n cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply()\n livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted\n HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in\n ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is\n parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this\n buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same\n structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.\n (CVE-2019-12521)\n\n - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is\n made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This\n causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker\n can connect to HTTP servers that only listen on localhost. (CVE-2019-12523)\n\n - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to\n see if the request should be denied. Squid by default comes with rules to block access to the Cache\n Manager, which serves detailed server information meant for the maintainer. This rule is implemented via\n url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to\n encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\n - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based\n buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to\n ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in\n the heap. (CVE-2019-12526)\n\n - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When\n Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.\n uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The\n length is then used to start decoding the string. There are no checks to ensure that the length it\n calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An\n attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the\n display of usernames on error pages. (CVE-2019-12529)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter\n to cachemgr.cgi. (CVE-2019-18860)\n\n - An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous\n function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when\n opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized\n error values are mapped to NULL, but later code expects that each error value is mapped to a valid error\n string. (CVE-2020-14058)\n\n - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to\n see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.\n If found, it servers the request. The absolute URL can include the decoded UserInfo (username and\n password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to\n provide a username that has special characters to delimit the domain, and treat the rest of the URL as a\n path or query string. An attacker could first make a request to their domain using an encoded username,\n then when a request for the target domain comes in that decodes to the exact URL, it will serve the\n attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows\n an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)\n\n - Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On\n systems with memory access protections, this can cause the CGI process to terminate unexpectedly,\n resulting in a denial of service for all clients using it. (CVE-2019-12854)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a\n heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity\n is high due to this vulnerability occurring before normal security checks; any remote client that can\n reach the proxy port can trivially perform the attack via a crafted URI scheme. (CVE-2019-18676)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because\n the appended characters do not properly interact with hostname length restrictions). Due to incorrect\n message processing, it can inappropriately redirect traffic to origins it should not be delivered to.\n (CVE-2019-18677)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests\n through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The\n resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content\n at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no\n effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing\n whitespace between a header name and a colon. (CVE-2019-18678)\n\n - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is\n vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the\n raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR\n protections and may aid attackers isolating memory areas to target for remote code execution attacks.\n (CVE-2019-18679)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2020-4743.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libecap, libecap-devel and / or squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-12526\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/07/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/09/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libecap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libecap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:squid\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(os_release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:os_release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\nvar module_ver = get_kb_item('Host/RedHat/appstream/squid');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\nif ('4' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module squid:' + module_ver);\n\nvar appstreams = {\n 'squid:4': [\n {'reference':'libecap-1.0.1-2.module+el8.3.0+7819+eb7d4ef6', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module+el8.3.0+7819+eb7d4ef6', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-4.11-3.module+el8.3.0+7819+eb7d4ef6', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'},\n {'reference':'libecap-1.0.1-2.module+el8.3.0+7819+eb7d4ef6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module+el8.3.0+7819+eb7d4ef6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-4.11-3.module+el8.3.0+7819+eb7d4ef6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'}\n ]\n};\n\nvar flag = 0;\nvar appstreams_found = 0;\nforeach var module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach var package_array ( appstreams[module] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && _release) {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libecap / libecap-devel / squid');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-15T14:56:12", "description": "The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14460-1 advisory.\n\n - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow. (CVE-2019-12519)\n\n - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.\n If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)\n\n - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.\n (CVE-2019-12521)\n\n - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost. (CVE-2019-12523)\n\n - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\n - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)\n\n - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap. (CVE-2019-12526)\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non- Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.\n uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. (CVE-2019-12529)\n\n - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.\n (CVE-2019-13345)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme. (CVE-2019-18676)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.\n (CVE-2019-18677)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. (CVE-2019-18678)\n\n - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.\n (CVE-2019-18679)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. (CVE-2019-18860)\n\n - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)\n\n - An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA problem during access to the memory page/slot management list. (CVE-2020-14059)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix to the length field-value. (CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.\n (CVE-2020-8517)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-06-10T00:00:00", "type": "nessus", "title": "SUSE SLES11 Security Update : squid3 (SUSE-SU-2020:14460-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-12519", "CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12525", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-13345", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-11945", "CVE-2020-14059", "CVE-2020-15049", "CVE-2020-8449", "CVE-2020-8450", "CVE-2020-8517"], "modified": "2022-05-09T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:squid3", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2020-14460-1.NASL", "href": "https://www.tenable.com/plugins/nessus/150657", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2020:14460-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(150657);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\n \"CVE-2019-12519\",\n \"CVE-2019-12520\",\n \"CVE-2019-12521\",\n \"CVE-2019-12523\",\n \"CVE-2019-12524\",\n \"CVE-2019-12525\",\n \"CVE-2019-12526\",\n \"CVE-2019-12528\",\n \"CVE-2019-12529\",\n \"CVE-2019-13345\",\n \"CVE-2019-18676\",\n \"CVE-2019-18677\",\n \"CVE-2019-18678\",\n \"CVE-2019-18679\",\n \"CVE-2019-18860\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-8517\",\n \"CVE-2020-11945\",\n \"CVE-2020-14059\",\n \"CVE-2020-15049\"\n );\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2020:14460-1\");\n\n script_name(english:\"SUSE SLES11 Security Update : squid3 (SUSE-SU-2020:14460-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in\nthe SUSE-SU-2020:14460-1 advisory.\n\n - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid\n calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's\n being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a\n new member to the stack. When adding a new member, there is no check to ensure that the stack won't\n overflow. (CVE-2019-12519)\n\n - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to\n see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request.\n If found, it servers the request. The absolute URL can include the decoded UserInfo (username and\n password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to\n provide a username that has special characters to delimit the domain, and treat the rest of the URL as a\n path or query string. An attacker could first make a request to their domain using an encoded username,\n then when a request for the target domain comes in that decodes to the exact URL, it will serve the\n attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows\n an attacker to gain access to features that only reverse proxies can use, such as ESI. (CVE-2019-12520)\n\n - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in\n ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is\n parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this\n buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same\n structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.\n (CVE-2019-12521)\n\n - An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is\n made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This\n causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker\n can connect to HTTP servers that only listen on localhost. (CVE-2019-12523)\n\n - An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to\n see if the request should be denied. Squid by default comes with rules to block access to the Cache\n Manager, which serves detailed server information meant for the maintainer. This rule is implemented via\n url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to\n encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\n - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use\n Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as\n domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it\n performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote\n (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)\n\n - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based\n buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to\n ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in\n the heap. (CVE-2019-12526)\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of\n sensitive information from heap memory, such as information associated with other users' sessions or non-\n Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When\n Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode.\n uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The\n length is then used to start decoding the string. There are no checks to ensure that the length it\n calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An\n attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the\n display of usernames on error pages. (CVE-2019-12529)\n\n - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.\n (CVE-2019-13345)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a\n heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity\n is high due to this vulnerability occurring before normal security checks; any remote client that can\n reach the proxy port can trivially perform the attack via a crafted URI scheme. (CVE-2019-18676)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because\n the appended characters do not properly interact with hostname length restrictions). Due to incorrect\n message processing, it can inappropriately redirect traffic to origins it should not be delivered to.\n (CVE-2019-18677)\n\n - An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests\n through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The\n resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content\n at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no\n effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing\n whitespace between a header name and a colon. (CVE-2019-18678)\n\n - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is\n vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the\n raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR\n protections and may aid attackers isolating memory areas to target for remote code execution attacks.\n (CVE-2019-18679)\n\n - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter\n to cachemgr.cgi. (CVE-2019-18860)\n\n - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest\n Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the\n attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if\n the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)\n\n - An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of\n Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA\n problem during access to the memory page/slot management list. (CVE-2020-14059)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A\n Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP\n request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix\n to the length field-value. (CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted\n HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can\n cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication\n credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with\n memory access protections, this can result in the helper process being terminated unexpectedly. This leads\n to the Squid process also terminating and a denial of service for all clients using the proxy.\n (CVE-2020-8517)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1140738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1141329\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1141332\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1156323\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1156324\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1156326\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1156328\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1156329\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1162687\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1162689\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1162691\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1167373\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1169659\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1170313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1170423\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1173304\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1173455\");\n # https://lists.suse.com/pipermail/sle-security-updates/2020-August/007289.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?d14abea9\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12519\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12520\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12524\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12525\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12526\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12528\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-12529\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-13345\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-18676\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-18677\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-18678\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-18679\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-18860\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-11945\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-14059\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-15049\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-8449\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-8450\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-8517\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid3 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-11945\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/05/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/08/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:squid3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES11', 'SUSE ' + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE ' + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP4\", os_ver + \" SP\" + sp);\n\npkgs = [\n {'reference':'squid3-3.1.23-8.16.37.12', 'sp':'4', 'release':'SLES11', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'SLES_SAP-release-11.4'},\n {'reference':'squid3-3.1.23-8.16.37.12', 'sp':'4', 'release':'SLES11', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'sles-release-11.4'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n exists_check = NULL;\n rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && release && exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n else if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n ltss_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in SUSE Enterprise Linux Server LTSS\\n' +\n 'repositories. Access to these package security updates require\\n' +\n 'a paid SUSE LTSS subscription.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + ltss_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'squid3');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "osv": [{"lastseen": "2022-08-10T07:19:05", "description": "\nTwo security issues were discovered in the Squid proxy caching\nserver, which could result in cache poisoning, request smuggling\nand incomplete validation of hostnames in cachemgr.cgi.\n\n\nFor the stable distribution (buster), these problems have been fixed in\nversion 4.6-1+deb10u3.\n\n\nWe recommend that you upgrade your squid packages.\n\n\nFor the detailed security status of squid please refer to\nits security tracker page at:\n[\\\nhttps://security-tracker.debian.org/tracker/squid](https://security-tracker.debian.org/tracker/squid)\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-07-21T00:00:00", "type": "osv", "title": "squid - security update", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-18860", "CVE-2020-15049"], "modified": "2022-08-10T07:19:02", "id": "OSV:DSA-4732-1", "href": "https://osv.dev/vulnerability/DSA-4732-1", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2022-08-05T05:18:51", "description": "\nIt was found that Squid, a high-performance proxy caching server for\nweb clients, has been affected by multiple security vulnerabilities.\nDue to incorrect input validation and URL request handling it was\npossible to bypass access restrictions for restricted HTTP servers\nand to cause a denial-of-service.\n\n\nFor Debian 9 stretch, these problems have been fixed in version\n3.5.23-5+deb9u2.\n\n\nWe recommend that you upgrade your squid3 packages.\n\n\nFor the detailed security status of squid3 please refer to\nits security tracker page at:\n<https://security-tracker.debian.org/tracker/squid3>\n\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: <https://wiki.debian.org/LTS>\n\n\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-07-10T00:00:00", "type": "osv", "title": "squid3 - security update", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12519", "CVE-2019-12529", "CVE-2019-12528", "CVE-2019-18677", "CVE-2019-12523", "CVE-2019-13345", "CVE-2019-18678", "CVE-2019-12524", "CVE-2019-12520", "CVE-2019-12521", "CVE-2019-18676", "CVE-2019-18860", "CVE-2020-8450", "CVE-2018-19132", "CVE-2019-12525", "CVE-2020-11945", "CVE-2019-12526", "CVE-2019-18679", "CVE-2020-8449"], "modified": "2022-08-05T05:18:49", "id": "OSV:DLA-2278-1", "href": "https://osv.dev/vulnerability/DLA-2278-1", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "ubuntu": [{"lastseen": "2023-12-03T20:45:28", "description": "## Releases\n\n * Ubuntu 20.04 LTS\n * Ubuntu 19.10 \n * Ubuntu 18.04 ESM\n * Ubuntu 16.04 ESM\n\n## Packages\n\n * squid \\- Web proxy cache server\n * squid3 \\- Web proxy cache server\n\nJeriko One discovered that Squid incorrectly handled certain Edge Side \nIncludes (ESI) responses. A malicious remote server could cause Squid to \ncrash, possibly poison the cache, or possibly execute arbitrary code. \n(CVE-2019-12519, CVE-2019-12521)\n\nIt was discovered that Squid incorrectly handled the hostname parameter to \ncachemgr.cgi when certain browsers are used. A remote attacker could \npossibly use this issue to inject HTML or invalid characters in the \nhostname parameter. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 \nLTS, and Ubuntu 19.10. (CVE-2019-18860)\n\nCl\u00e9ment Berthaux and Florian Guilbert discovered that Squid incorrectly \nhandled Digest Authentication nonce values. A remote attacker could \nuse this issue to replay nonce values, or possibly execute arbitrary code. \n(CVE-2020-11945)\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-05-13T00:00:00", "type": "ubuntu", "title": "Squid vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12519", "CVE-2019-12521", "CVE-2019-18860", "CVE-2020-11945"], "modified": "2020-05-13T00:00:00", "id": "USN-4356-1", "href": "https://ubuntu.com/security/notices/USN-4356-1", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "suse": [{"lastseen": "2022-04-18T12:41:20", "description": "An update that fixes 6 vulnerabilities is now available.\n\nDescription:\n\n This update for squid to version 4.11 fixes the following issues:\n\n - CVE-2020-11945: Fixed a potential remote code execution vulnerability\n when using HTTP Digest Authentication (bsc#1170313).\n - CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can\n result in cache poisoning, remote execution, and denial of service\n attacks when processing ESI responses (bsc#1169659).\n - CVE-2020-8517: Fixed a possible denial of service caused by incorrect\n buffer management ext_lm_group_acl when processing NTLM Authentication\n credentials (bsc#1162691).\n - CVE-2019-12528: Fixed possible information disclosure when translating\n FTP server listings into HTTP responses (bsc#1162689).\n - CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi\n (bsc#1167373).\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.1:\n\n zypper in -t patch openSUSE-2020-623=1", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-05-11T00:00:00", "type": "suse", "title": "Security update for squid (important)", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12519", "CVE-2019-12521", "CVE-2019-12528", "CVE-2019-18860", "CVE-2020-11945", "CVE-2020-8517"], "modified": "2020-05-11T00:00:00", "id": "OPENSUSE-SU-2020:0623-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PKK52WC254R33WBSNPYY4IHIZMYTJYNU/", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "amazon": [{"lastseen": "2023-11-07T18:12:25", "description": "**Issue Overview:**\n\nDue to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication\n\nAn issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\nAn issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. (CVE-2019-12529)\n\nAn issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to. (CVE-2019-18677)\n\nAn issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. (CVE-2019-18678)\n\nSquid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. (CVE-2019-18860)\n\nSquid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody. (CVE-2021-28116)\n\n \n**Affected Packages:** \n\n\nsquid\n\n \n**Issue Correction:** \nRun _yum update squid_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n aarch64: \n \u00a0\u00a0\u00a0 squid-3.5.20-17.amzn2.7.10.aarch64 \n \u00a0\u00a0\u00a0 squid-sysvinit-3.5.20-17.amzn2.7.10.aarch64 \n \u00a0\u00a0\u00a0 squid-migration-script-3.5.20-17.amzn2.7.10.aarch64 \n \u00a0\u00a0\u00a0 squid-debuginfo-3.5.20-17.amzn2.7.10.aarch64 \n \n i686: \n \u00a0\u00a0\u00a0 squid-3.5.20-17.amzn2.7.10.i686 \n \u00a0\u00a0\u00a0 squid-sysvinit-3.5.20-17.amzn2.7.10.i686 \n \u00a0\u00a0\u00a0 squid-migration-script-3.5.20-17.amzn2.7.10.i686 \n \u00a0\u00a0\u00a0 squid-debuginfo-3.5.20-17.amzn2.7.10.i686 \n \n src: \n \u00a0\u00a0\u00a0 squid-3.5.20-17.amzn2.7.10.src \n \n x86_64: \n \u00a0\u00a0\u00a0 squid-3.5.20-17.amzn2.7.10.x86_64 \n \u00a0\u00a0\u00a0 squid-sysvinit-3.5.20-17.amzn2.7.10.x86_64 \n \u00a0\u00a0\u00a0 squid-migration-script-3.5.20-17.amzn2.7.10.x86_64 \n \u00a0\u00a0\u00a0 squid-debuginfo-3.5.20-17.amzn2.7.10.x86_64 \n \n \n\n### Additional References\n\nRed Hat: [CVE-2019-12524](<https://access.redhat.com/security/cve/CVE-2019-12524>), [CVE-2019-12529](<https://access.redhat.com/security/cve/CVE-2019-12529>), [CVE-2019-18677](<https://access.redhat.com/security/cve/CVE-2019-18677>), [CVE-2019-18678](<https://access.redhat.com/security/cve/CVE-2019-18678>), [CVE-2019-18860](<https://access.redhat.com/security/cve/CVE-2019-18860>), [CVE-2021-28116](<https://access.redhat.com/security/cve/CVE-2021-28116>)\n\nMitre: [CVE-2019-12524](<https://vulners.com/cve/CVE-2019-12524>), [CVE-2019-12529](<https://vulners.com/cve/CVE-2019-12529>), [CVE-2019-18677](<https://vulners.com/cve/CVE-2019-18677>), [CVE-2019-18678](<https://vulners.com/cve/CVE-2019-18678>), [CVE-2019-18860](<https://vulners.com/cve/CVE-2019-18860>), [CVE-2021-28116](<https://vulners.com/cve/CVE-2021-28116>)\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-10-25T21:40:00", "type": "amazon", "title": "Critical: squid", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12524", "CVE-2019-12529", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18860", "CVE-2021-28116"], "modified": "2023-10-26T22:57:00", "id": "ALAS2-2023-2318", "href": "https://alas.aws.amazon.com/AL2/ALAS-2023-2318.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-03T18:36:29", "description": "**Issue Overview:**\n\nAn issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource. (CVE-2019-12524)\n\nAn issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. (CVE-2019-12529)\n\nAn issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to. (CVE-2019-18677)\n\nAn issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. (CVE-2019-18678)\n\nSquid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. (CVE-2019-18860)\n\nSquid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody. (CVE-2021-28116)\n\nDue to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication (CVE-2023-46847)\n\n \n**Affected Packages:** \n\n\nsquid\n\n \n**Note:**\n\nThis advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this [FAQ section](<../../faqs.html#clarify-al2-advisories>) for the difference between AL2 Core and AL2 Extras advisories. \n\n \n**Issue Correction:** \nRun _yum update squid_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n aarch64: \n \u00a0\u00a0\u00a0 squid-3.5.20-17.amzn2.7.10.aarch64 \n \u00a0\u00a0\u00a0 squid-sysvinit-3.5.20-17.amzn2.7.10.aarch64 \n \u00a0\u00a0\u00a0 squid-migration-script-3.5.20-17.amzn2.7.10.aarch64 \n \u00a0\u00a0\u00a0 squid-debuginfo-3.5.20-17.amzn2.7.10.aarch64 \n \n i686: \n \u00a0\u00a0\u00a0 squid-3.5.20-17.amzn2.7.10.i686 \n \u00a0\u00a0\u00a0 squid-sysvinit-3.5.20-17.amzn2.7.10.i686 \n \u00a0\u00a0\u00a0 squid-migration-script-3.5.20-17.amzn2.7.10.i686 \n \u00a0\u00a0\u00a0 squid-debuginfo-3.5.20-17.amzn2.7.10.i686 \n \n src: \n \u00a0\u00a0\u00a0 squid-3.5.20-17.amzn2.7.10.src \n \n x86_64: \n \u00a0\u00a0\u00a0 squid-3.5.20-17.amzn2.7.10.x86_64 \n \u00a0\u00a0\u00a0 squid-sysvinit-3.5.20-17.amzn2.7.10.x86_64 \n \u00a0\u00a0\u00a0 squid-migration-script-3.5.20-17.amzn2.7.10.x86_64 \n \u00a0\u00a0\u00a0 squid-debuginfo-3.5.20-17.amzn2.7.10.x86_64 \n \n \n\n### Additional References\n\nRed Hat: [CVE-2019-12524](<https://access.redhat.com/security/cve/CVE-2019-12524>), [CVE-2019-12529](<https://access.redhat.com/security/cve/CVE-2019-12529>), [CVE-2019-18677](<https://access.redhat.com/security/cve/CVE-2019-18677>), [CVE-2019-18678](<https://access.redhat.com/security/cve/CVE-2019-18678>), [CVE-2019-18860](<https://access.redhat.com/security/cve/CVE-2019-18860>), [CVE-2021-28116](<https://access.redhat.com/security/cve/CVE-2021-28116>), [CVE-2023-46847](<https://access.redhat.com/security/cve/CVE-2023-46847>)\n\nMitre: [CVE-2019-12524](<https://vulners.com/cve/CVE-2019-12524>), [CVE-2019-12529](<https://vulners.com/cve/CVE-2019-12529>), [CVE-2019-18677](<https://vulners.com/cve/CVE-2019-18677>), [CVE-2019-18678](<https://vulners.com/cve/CVE-2019-18678>), [CVE-2019-18860](<https://vulners.com/cve/CVE-2019-18860>), [CVE-2021-28116](<https://vulners.com/cve/CVE-2021-28116>), [CVE-2023-46847](<https://vulners.com/cve/CVE-2023-46847>)\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-10-25T21:40:00", "type": "amazon", "title": "Critical: squid", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12524", "CVE-2019-12529", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18860", "CVE-2021-28116", "CVE-2023-46847"], "modified": "2023-11-06T21:16:00", "id": "ALAS-2023-2318", "href": "https://alas.aws.amazon.com/AL2/ALAS-2023-2318.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "mskb": [{"lastseen": "2023-11-28T09:38:35", "description": "None\n## Summary\n\nThis security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see the following security advisories:\n\n * [Microsoft Common Vulnerabilities and Exposures CVE-2020-1494](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1494>)\n * [Microsoft Common Vulnerabilities and Exposures CVE-2020-1495](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1495>)\n * [Microsoft Common Vulnerabilities and Exposures CVE-2020-1496](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1496>)\n * [Microsoft Common Vulnerabilities and Exposures CVE-2020-1497](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1497>)\n * [Microsoft Common Vulnerabilities and Exposures CVE-2020-1498](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1498>)\n * [Microsoft Common Vulnerabilities and Exposures CVE-2020-1504](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1504>)\n**Note** To apply this security update, you must have the release version of [Service Pack 2 for Office 2010](<http://support.microsoft.com/kb/2687455>) installed on the computer.Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2010. It doesn't apply to the Office 2010 Click-to-Run editions, such as Microsoft Office 2010 Home and Student (see [What version of Office am I using?](<https://support.office.com/en-us/article/About-Office-What-version-of-Office-am-I-using-932788B8-A3CE-44BF-BB09-E334518B8B19>)).\n\n## How to get and install the update\n\n### Method 1: Microsoft Update\n\nThis update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see [Windows Update: FAQ](<https://support.microsoft.com/en-us/help/12373/windows-update-faq>).\n\n### Method 2: Microsoft Update Catalog\n\nTo get the standalone package for this update, go to the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/Search.aspx?q=KB4484461>) website.\n\n### Method 3: Microsoft Download Center\n\nYou can get the standalone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.\n\n * [Download security update 4484461 for the 32-bit version of Excel 2010](<http://www.microsoft.com/download/details.aspx?familyid=89e58aa3-508b-4b9d-9d38-fe78c2d61d77>)\n * [Download security update 4484461 for the 64-bit version of Excel 2010](<http://www.microsoft.com/download/details.aspx?familyid=170af43e-827e-4846-94f1-1065031629df>)\n\n## More information\n\n### Security update deployment information\n\nFor deployment information about this update, see [security update deployment information: August 11, 2020](<https://support.microsoft.com/en-us/help/20200811>).\n\n### Security update replacement information\n\nThis security update replaces previously released security update [4484415](<http://support.microsoft.com/kb/4484415>).\n\n### File hash information\n\nFile name| SHA1 hash| SHA256 hash \n---|---|--- \nexcel2010-kb4484461-fullfile-x86-glb.exe| 859A087A81FA170EBC6E373E83419C8B66E7965B| B8C5D89131D0B3F655EBE147DC89FD2B63E7DDBF8E85FDB6C8758CC87F8CABBE \nexcel2010-kb4484461-fullfile-x64-glb.exe| A6401C8D258F9B5B5A59023CD27D501BE8823455| 73EF12FFEB808CC29786638F48022D579370AB5FD86DFD3BA4510DA2666C98A7 \n \nFile informationThe English (United States) version of this software update installs files that have the attributes that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.\n\n## \n\n__\n\nFor all supported x86-based versions of Excel 2010\n\nFile identifier| File name| File version| File size| Date| Time \n---|---|---|---|---|--- \nexcel.exe| excel.exe| 14.0.7256.5000| 20,420,200| 18-Jul-2020| 08:43 \nexcel.man| excel.exe.manifest| | 1,194| 05-Nov-2009| 11:00 \nxl12cnv.exe| excelcnv.exe| 14.0.7256.5000| 17,856,616| 16-Jul-2020| 06:08 \nxlcall32.dll| xlcall32.dll| 14.0.7162.5000| 10,432| 13-Oct-2015| 06:52 \nxlicons.exe| xlicons.exe| 14.0.7120.5000| 1,480,360| 05-Mar-2014| 06:06 \n \n## \n\n__\n\nFor all supported x64-based versions of Excel 2010\n\nFile identifier| File name| File version| File size| Date| Time \n---|---|---|---|---|--- \nexcel.exe| excel.exe| 14.0.7256.5000| 27,678,336| 18-Jul-2020| 08:43 \nexcel.man| excel.exe.manifest| | 1,196| 05-Nov-2009| 11:23 \nxl12cnv.exe| excelcnv.exe| 14.0.7256.5000| 25,071,736| 16-Jul-2020| 06:25 \nxlcall32.dll| xlcall32.dll| 14.0.7162.5000| 10,944| 13-Oct-2015| 07:00 \nxlicons.exe| xlicons.exe| 14.0.7120.5000| 1,480,360| 05-Mar-2014| 06:06 \n \nInformation about protection and securityProtect yourself online: [Windows Security support](<https://support.microsoft.com/hub/4099151>)Learn how we guard against cyber threats: [Microsoft Security](<https://www.microsoft.com/security>)\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-11T00:00:00", "type": "mskb", "title": "Description of the security update for Excel 2010: August 11, 2020", "bulletinFamily": "microsoft", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1497", "CVE-2020-1498", "CVE-2020-1504"], "modified": "2020-08-11T00:00:00", "id": "KB4484461", "href": "https://support.microsoft.com/en-us/help/4484461", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "redhat": [{"lastseen": "2023-12-04T18:42:04", "description": "Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nThe following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)\n\nSecurity Fix(es):\n\n* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n* squid: Improper input validation in URI processor (CVE-2019-12523)\n\n* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n* squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n* squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\n* squid: DoS in TLS handshake (CVE-2020-14058)\n\n* squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n* squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-11-03T12:32:17", "type": "redhat", "title": "(RHSA-2020:4743) Moderate: squid:4 security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2020-11-04T00:02:31", "id": "RHSA-2020:4743", "href": "https://access.redhat.com/errata/RHSA-2020:4743", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "almalinux": [{"lastseen": "2023-12-03T17:28:39", "description": "Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nThe following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)\n\nSecurity Fix(es):\n\n* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n* squid: Improper input validation in URI processor (CVE-2019-12523)\n\n* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n* squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n* squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\n* squid: DoS in TLS handshake (CVE-2020-14058)\n\n* squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n* squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-11-03T12:32:17", "type": "almalinux", "title": "Moderate: squid:4 security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2020-11-03T19:54:15", "id": "ALSA-2020:4743", "href": "https://errata.almalinux.org/8/ALSA-2020-4743.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "rocky": [{"lastseen": "2023-12-03T17:28:26", "description": "An update is available for libecap.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list\nSquid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nThe following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)\n\nSecurity Fix(es):\n\n* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n* squid: Improper input validation in URI processor (CVE-2019-12523)\n\n* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n* squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n* squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\n* squid: DoS in TLS handshake (CVE-2020-14058)\n\n* squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n* squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-11-03T12:32:17", "type": "rocky", "title": "squid:4 security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2020-11-03T12:32:17", "id": "RLSA-2020:4743", "href": "https://errata.rockylinux.org/RLSA-2020:4743", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "oraclelinux": [{"lastseen": "2021-11-23T02:27:50", "description": " ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-11-10T00:00:00", "type": "oraclelinux", "title": "squid:4 security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2020-11-10T00:00:00", "id": "ELSA-2020-4743", "href": "http://linux.oracle.com/errata/ELSA-2020-4743.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2023-12-03T16:57:04", "description": "- -------------------------------------------------------------------------\nDebian LTS Advisory DLA-2278-1 debian-lts@lists.debian.org\nhttps://www.debian.org/lts/security/ Markus Koschany\nJuly 10, 2020 https://wiki.debian.org/LTS\n- -------------------------------------------------------------------------\n\nPackage : squid3\nVersion : 3.5.23-5+deb9u2\nCVE ID : CVE-2018-19132 CVE-2019-12519 CVE-2019-12520\n CVE-2019-12521 CVE-2019-12523 CVE-2019-12524\n CVE-2019-12525 CVE-2019-12526 CVE-2019-12528\n CVE-2019-12529 CVE-2019-13345 CVE-2019-18676\n CVE-2019-18677 CVE-2019-18678 CVE-2019-18679\n CVE-2019-18860 CVE-2020-8449 CVE-2020-8450\n CVE-2020-11945\nDebian Bug : 950802 931478 950925 912294\n\nIt was found that Squid, a high-performance proxy caching server for\nweb clients, has been affected by multiple security vulnerabilities.\nDue to incorrect input validation and URL request handling it was\npossible to bypass access restrictions for restricted HTTP servers\nand to cause a denial-of-service.\n\nFor Debian 9 stretch, these problems have been fixed in version\n3.5.23-5+deb9u2.\n\nWe recommend that you upgrade your squid3 packages.\n\nFor the detailed security status of squid3 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/squid3\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-07-10T21:55:24", "type": "debian", "title": "[SECURITY] [DLA 2278-1] squid3 security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-19132", "CVE-2019-12519", "CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12525", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-13345", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-11945", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2020-07-10T21:55:24", "id": "DEBIAN:DLA-2278-1:83AD0", "href": "https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-22T11:20:59", "description": "- -------------------------------------------------------------------------\nDebian LTS Advisory DLA-2278-1 debian-lts@lists.debian.org\nhttps://www.debian.org/lts/security/ Markus Koschany\nJuly 10, 2020 https://wiki.debian.org/LTS\n- -------------------------------------------------------------------------\n\nPackage : squid3\nVersion : 3.5.23-5+deb9u2\nCVE ID : CVE-2018-19132 CVE-2019-12519 CVE-2019-12520\n CVE-2019-12521 CVE-2019-12523 CVE-2019-12524\n CVE-2019-12525 CVE-2019-12526 CVE-2019-12528\n CVE-2019-12529 CVE-2019-13345 CVE-2019-18676\n CVE-2019-18677 CVE-2019-18678 CVE-2019-18679\n CVE-2019-18860 CVE-2020-8449 CVE-2020-8450\n CVE-2020-11945\nDebian Bug : 950802 931478 950925 912294\n\nIt was found that Squid, a high-performance proxy caching server for\nweb clients, has been affected by multiple security vulnerabilities.\nDue to incorrect input validation and URL request handling it was\npossible to bypass access restrictions for restricted HTTP servers\nand to cause a denial-of-service.\n\nFor Debian 9 stretch, these problems have been fixed in version\n3.5.23-5+deb9u2.\n\nWe recommend that you upgrade your squid3 packages.\n\nFor the detailed security status of squid3 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/squid3\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-07-10T21:55:24", "type": "debian", "title": "[SECURITY] [DLA 2278-1] squid3 security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-19132", "CVE-2019-12519", "CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12525", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-13345", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-11945", "CVE-2020-8449", "CVE-2020-8450"], "modified": "2020-07-10T21:55:24", "id": "DEBIAN:DLA-2278-1:4A30F", "href": "https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "kaspersky": [{"lastseen": "2023-12-03T19:19:23", "description": "### *Detect date*:\n08/11/2020\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface, execute arbitrary code, gain privileges.\n\n### *Affected products*:\nMicrosoft SharePoint Server 2010 Service Pack 2 \nMicrosoft Outlook 2016 (32-bit edition) \nMicrosoft Access 2010 Service Pack 2 (64-bit editions) \nMicrosoft Office 2016 (64-bit edition) \nMicrosoft Office 2010 Service Pack 2 (64-bit editions) \nMicrosoft Office Web Apps 2010 Service Pack 2 \nOffice Online Server \nMicrosoft Office 2019 for 32-bit editions \nMicrosoft 365 Apps for Enterprise for 64-bit Systems \nMicrosoft SharePoint Enterprise Server 2013 Service Pack 1 \nMicrosoft Office 2013 Click-to-Run (C2R) for 64-bit editions \nMicrosoft Excel 2013 RT Service Pack 1 \nMicrosoft Outlook 2016 (64-bit edition) \nMicrosoft Outlook 2010 Service Pack 2 (64-bit editions) \nMicrosoft Office Online Server \nMicrosoft Word 2016 (64-bit edition) \nMicrosoft Outlook 2010 Service Pack 2 (32-bit editions) \nMicrosoft Word 2013 Service Pack 1 (64-bit editions) \nMicrosoft Access 2013 Service Pack 1 (32-bit editions) \nMicrosoft Office 2013 Click-to-Run (C2R) for 32-bit editions \nMicrosoft SharePoint Foundation 2010 Service Pack 2 \nMicrosoft Word 2010 Service Pack 2 (32-bit editions) \nMicrosoft Word 2013 Service Pack 1 (32-bit editions) \nMicrosoft Office 2013 RT Service Pack 1 \nMicrosoft Excel 2013 Service Pack 1 (64-bit editions) \nMicrosoft Access 2016 (32-bit edition) \nMicrosoft Outlook 2013 Service Pack 1 (32-bit editions) \nMicrosoft Word 2016 (32-bit edition) \nMicrosoft Office 2019 for 64-bit editions \nMicrosoft SharePoint Foundation 2013 Service Pack 1 \nMicrosoft Office 2016 (32-bit edition) \nMicrosoft Office Web Apps 2013 Service Pack 1 \nMicrosoft SharePoint Server 2019 \nMicrosoft Excel 2010 Service Pack 2 (64-bit editions) \nMicrosoft Office 2010 Service Pack 2 (32-bit editions) \nMicrosoft Office 2016 for Mac \nMicrosoft Excel 2013 Service Pack 1 (32-bit editions) \nMicrosoft Outlook 2013 RT Service Pack 1 \nMicrosoft Office 2019 for Mac \nMicrosoft Access 2016 (64-bit edition) \nMicrosoft Outlook 2013 Service Pack 1 (64-bit editions) \nMicrosoft Excel 2016 (32-bit edition) \nMicrosoft SharePoint Enterprise Server 2016 \nMicrosoft 365 Apps for Enterprise for 32-bit Systems \nMicrosoft Office 2013 Service Pack 1 (64-bit editions) \nMicrosoft Access 2010 Service Pack 2 (32-bit editions) \nMicrosoft Office 2013 Service Pack 1 (32-bit editions) \nMicrosoft Word 2010 Service Pack 2 (64-bit editions) \nMicrosoft Word 2013 RT Service Pack 1 \nMicrosoft Excel 2010 Service Pack 2 (32-bit editions) \nMicrosoft Excel 2016 (64-bit edition) \nMicrosoft Access 2013 Service Pack 1 (64-bit editions)\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2020-1493](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1493>) \n[CVE-2020-1573](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1573>) \n[CVE-2020-1497](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1497>) \n[CVE-2020-1583](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1583>) \n[CVE-2020-1495](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1495>) \n[CVE-2020-1494](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1494>) \n[CVE-2020-1499](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1499>) \n[CVE-2020-1498](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1498>) \n[CVE-2020-1563](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1563>) \n[CVE-2020-1483](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1483>) \n[CVE-2020-1582](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1582>) \n[CVE-2020-1580](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1580>) \n[CVE-2020-1505](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1505>) \n[CVE-2020-1581](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1581>) \n[CVE-2020-1504](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1504>) \n[CVE-2020-1502](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1502>) \n[CVE-2020-1501](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1501>) \n[CVE-2020-1500](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1500>) \n[CVE-2020-1503](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1503>) \n[CVE-2020-1496](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1496>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Access](<https://threats.kaspersky.com/en/product/Microsoft-Access/>)\n\n### *CVE-IDS*:\n[CVE-2020-1493](<https://vulners.com/cve/CVE-2020-1493>)4.3Warning \n[CVE-2020-1573](<https://vulners.com/cve/CVE-2020-1573>)3.5Warning \n[CVE-2020-1497](<https://vulners.com/cve/CVE-2020-1497>)4.3Warning \n[CVE-2020-1583](<https://vulners.com/cve/CVE-2020-1583>)4.3Warning \n[CVE-2020-1495](<https://vulners.com/cve/CVE-2020-1495>)9.3Critical \n[CVE-2020-1494](<https://vulners.com/cve/CVE-2020-1494>)9.3Critical \n[CVE-2020-1499](<https://vulners.com/cve/CVE-2020-1499>)5.5High \n[CVE-2020-1498](<https://vulners.com/cve/CVE-2020-1498>)9.3Critical \n[CVE-2020-1563](<https://vulners.com/cve/CVE-2020-1563>)9.3Critical \n[CVE-2020-1483](<https://vulners.com/cve/CVE-2020-1483>)9.3Critical \n[CVE-2020-1582](<https://vulners.com/cve/CVE-2020-1582>)6.8High \n[CVE-2020-1580](<https://vulners.com/cve/CVE-2020-1580>)3.5Warning \n[CVE-2020-1505](<https://vulners.com/cve/CVE-2020-1505>)2.1Warning \n[CVE-2020-1581](<https://vulners.com/cve/CVE-2020-1581>)9.3Critical \n[CVE-2020-1504](<https://vulners.com/cve/CVE-2020-1504>)9.3Critical \n[CVE-2020-1502](<https://vulners.com/cve/CVE-2020-1502>)4.3Warning \n[CVE-2020-1501](<https://vulners.com/cve/CVE-2020-1501>)5.5High \n[CVE-2020-1500](<https://vulners.com/cve/CVE-2020-1500>)5.5High \n[CVE-2020-1503](<https://vulners.com/cve/CVE-2020-1503>)4.3Warning \n[CVE-2020-1496](<https://vulners.com/cve/CVE-2020-1496>)9.3Critical\n\n### *KB list*:\n[4484476](<http://support.microsoft.com/kb/4484476>) \n[4484191](<http://support.microsoft.com/kb/4484191>) \n[4484379](<http://support.microsoft.com/kb/4484379>) \n[4484359](<http://support.microsoft.com/kb/4484359>) \n[4484465](<http://support.microsoft.com/kb/4484465>) \n[4484449](<http://support.microsoft.com/kb/4484449>) \n[4484354](<http://support.microsoft.com/kb/4484354>) \n[4484461](<http://support.microsoft.com/kb/4484461>) \n[4484470](<http://support.microsoft.com/kb/4484470>) \n[4484462](<http://support.microsoft.com/kb/4484462>) \n[4484375](<http://support.microsoft.com/kb/4484375>) \n[4484487](<http://support.microsoft.com/kb/4484487>) \n[4484486](<http://support.microsoft.com/kb/4484486>) \n[4484484](<http://support.microsoft.com/kb/4484484>) \n[4484481](<http://support.microsoft.com/kb/4484481>) \n[4484366](<http://support.microsoft.com/kb/4484366>) \n[4484183](<http://support.microsoft.com/kb/4484183>) \n[4484478](<http://support.microsoft.com/kb/4484478>) \n[4484479](<http://support.microsoft.com/kb/4484479>) \n[4484431](<http://support.microsoft.com/kb/4484431>) \n[4484472](<http://support.microsoft.com/kb/4484472>) \n[4484473](<http://support.microsoft.com/kb/4484473>) \n[4484346](<http://support.microsoft.com/kb/4484346>) \n[4484471](<http://support.microsoft.com/kb/4484471>) \n[4484340](<http://support.microsoft.com/kb/4484340>) \n[4484474](<http://support.microsoft.com/kb/4484474>) \n[4484475](<http://support.microsoft.com/kb/4484475>) \n[4484385](<http://support.microsoft.com/kb/4484385>) \n[4484494](<http://support.microsoft.com/kb/4484494>) \n[4484495](<http://support.microsoft.com/kb/4484495>) \n[4484497](<http://support.microsoft.com/kb/4484497>) \n[4484490](<http://support.microsoft.com/kb/4484490>) \n[4484492](<http://support.microsoft.com/kb/4484492>) \n[4484498](<http://support.microsoft.com/kb/4484498>)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-08-11T00:00:00", "type": "kaspersky", "title": "KLA11932 Multiple vulnerabilities in Microsoft Office", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-1483", "CVE-2020-1493", "CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1497", "CVE-2020-1498", "CVE-2020-1499", "CVE-2020-1500", "CVE-2020-1501", "CVE-2020-1502", "CVE-2020-1503", "CVE-2020-1504", "CVE-2020-1505", "CVE-2020-1563", "CVE-2020-1573", "CVE-2020-1580", "CVE-2020-1581", "CVE-2020-1582", "CVE-2020-1583"], "modified": "2020-08-18T00:00:00", "id": "KLA11932", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11932/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "rosalinux": [{"lastseen": "2023-12-03T21:45:01", "description": "Software: squid 3.5.20\nOS: Cobalt 7.9\n \nCVE-ID: CVE-2016-10003\nCVE-Crit: HIGH\nCVE-DESC: An incorrect comparison of HTTP request headers in Squid HTTP Proxy 3.5.0.0.1-3.5.22 and 4.0.1-4.0.16 causes Collapsed Forwarding to incorrectly identify some private responses as suitable for delivery to multiple clients. \nCVE-STATUS: Default\nCVE-REV: default\n \n \nCVE-ID: CVE-2018-19131\nCVE-Crit: MEDIUM\nCVE-DESC: Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP error page (S) generation for certificate errors. \nCVE-STATUS: Default\nCVE-REV: Default\n \n \nCVE-ID: CVE-2018-19132\nCVE-Crit: MEDIUM\nCVE-DESC: Squid before 4.4, when SNMP is enabled, allows denial of service (memory leak) via SNMP packet. \nCVE-STATUS: Default\nCVE-REV: Default\n \n \nCVE-ID: CVE-2019-12526\nCVE-Crit: CRITICAL\nCVE-DESC: An issue was discovered in Squid prior to version 4.9. The processing of URN responses in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to a URN request, Squid cannot ensure that the response fits in the buffer. This results in a heap-based data overflow controlled by an attacker. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2019-12528\nCVE-Crit: HIGH\nCVE-DESC: An issue was discovered in Squid prior to 4.10. This allows an engineered FTP server to initiate the disclosure of sensitive information from dynamic memory, such as information related to other users' sessions or non-Squid processes. \nCVE-STATUS: Default\nCVE-REV: default\n \n \nCVE-ID: CVE-2019-12529\nCVE-Crit: MEDIUM\nCVE-DESC: The issue was found in Squid 2.x - 2.7.STABLE9, 3.x - 3.5.28, and 4.x - 4.7. When Squid is configured to use basic authentication, the Proxy-Authorization header is parsed by uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to make sure that the calculated length does not exceed the input buffer size. This results in decoding and contiguous memory. An attacker cannot get the decoded data unless the Squid maintainer has configured the display of usernames on error pages. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2019-12523\nCVE-Crit: CRITICAL\nCVE-DESC: An issue was discovered in Squid before version 4.9. When processing a URN request, the corresponding HTTP request is executed. This HTTP request does not pass the access checks that incoming HTTP requests pass. This has the effect of bypassing all access checks and allowing access to restricted HTTP servers, e.g. an attacker can connect to HTTP servers that only listen to localhost. \nCVE-STATUS: Default\nCVE-REV: Default\n \n \nCVE-ID: CVE-2019-12524\nCVE-Crit: CRITICAL\nCVE-DESC: An issue was discovered in Squid prior to version 4.7. When processing requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which provides detailed server information intended for maintenance personnel. This rule is implemented via url_regex. The url_regex rule URL handler decodes the incoming request. This allows an attacker to encode their URL to bypass the url_regex check and access the blocked resource. \nCVE-STATUS: Default\nCVE-REV: Default\n \n \nCVE-ID: CVE-2019-12521\nCVE-Crit: MEDIUM\nCVE-DESC: An issue was discovered in Squid before version 4.7. When Squid analyzes ESI, it stores ESI items in ESIContext. ESIContext contains a buffer to store a stack of ESIElements. When a new ESIElement is analyzed, it is added via addStackElement. The addStackElement has a check for the number of elements in this buffer, but it is disabled at 1, which results in a heap overflow of 1 element. The overflow is in the same structure, so it cannot affect neighboring memory blocks and thus just causes a failure during processing. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2019-12520\nCVE-Crit: HIGH\nCVE-DESC: The issue was discovered in Squid through 4.7 and 5. When Squid receives a request, it checks its cache to see if it can handle the response. It does this by creating an MD5 hash of the absolute URL of the request. If it is found, it serves the request. The absolute URL may include decoded UserInfo (username and password) for certain protocols. This decoded information is appended to the domain. This allows an attacker to specify a username with special characters to separate the domain and treat the rest of the URL as a path or query string. An attacker can first make a request to their domain using the encoded username, and then when a request comes in for the target domain that is decoded with the exact URL, it will serve the attacker HTML instead of the actual HTML. On Squid servers that also act as reverse proxies, this allows the attacker to access features that only reverse proxies can use, such as ESI. \nCVE-STATUS: Default\nCVE-REV: Default\n \n \nCVE-ID: CVE-2019-12522\nCVE-Crit: MEDIUM\nCVE-DESC: An issue was discovered in Squid before version 4.7. When Squid is started as root, it spawns its child processes as a smaller user, the default user is nobody. This is done by calling leave_suid. leave_suid leaves the saved UID set to 0. This makes it trivial for an attacker who has compromised a child process to elevate its privileges to root. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2019-18677\nCVE-Crit: MEDIUM\nCVE-DESC: An issue was found in Squid 3.x and 4.x through 4.8 when using the append_domain parameter (because the appended characters do not interact properly with hostname length restrictions). Due to improper handling of the message, it can incorrectly redirect traffic to sources it should not be delivered to. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2019-18678\nCVE-Crit: MEDIUM\nCVE-DESC: An issue has been discovered in Squid 3.x and 4.x through 4.8. This allows attackers to pass HTTP requests through the interface software to a Squid instance that shares the HTTP request pipeline differently. The resulting Response messages corrupt caches (between the client and Squid) with content controlled by the attacker to arbitrary URLs. The software consequences are isolated between the attacker and Squid. It does not affect Squid itself or any upstream servers. The problem is due to the request header containing spaces between the header name and the colon. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2019-18679\nCVE-Crit: HIGH\nCVE-DESC: The issue was discovered in Squid 2.x, 3.x and 4.x through 4.8. Due to improper data management, it is vulnerable to information disclosure when processing HTTP digest authentication. Nonce markers contain the raw byte value of a pointer located in allocated heap memory. This information reduces ASLR defenses and can help attackers isolate memory regions for remote code execution attacks. \nCVE-STATUS: Default\nCVE-REV: Default\n \n \nCVE-ID: CVE-2019-18860\nCVE-Crit: MEDIUM\nCVE-DESC: Squid before 4.9, when certain web browsers are used, does not properly handle HTML in the host parameter (also known as hostname) in cachemgr.cgi. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2019-18676\nCVE-Crit: HIGH\nCVE-DESC: An issue has been found in Squid 3.x and 4.x through 4.8. Improper input validation causes a heap-based buffer overflow, which can cause a denial of service for all clients using the proxy. The severity is high because this vulnerability occurs before normal security checks; any remote client that can contact the proxy port can easily perform an attack through the generated URI scheme. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-15811\nCVE-Crit: MEDIUM\nCVE-DESC: The issue was found in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP request separation attacks can be successful for HTTP and HTTPS traffic. This results in cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any subsequent caches with content from an arbitrary source. Squid uses string search instead of analyzing the Transfer-Encoding header to find fragmented encoding. This allows an attacker to hide a second request within Transfer-Encoding: it is interpreted by Squid as fragmented and split into a second request delivered in the upstream direction. Squid will then send two different responses to the client, corrupting all downstream caches. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-15810\nCVE-Crit: MEDIUM\nCVE-DESC: The issue was found in Squid before 4.13 and 5.x before 5.0.4. Due to improper data validation, HTTP request smuggling attacks can be successful against HTTP and HTTPS traffic. This results in cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any subsequent caches with content from an arbitrary source. When configured for simplified header parsing (the default), Squid retransmits headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the specified frame length will be ignored by Squid (allowing the conflicting length from another Content-Length header to be used) but retransmitted upstream. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-14058\nCVE-Crit: HIGH\nCVE-DESC: The issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to the use of a potentially dangerous feature, Squid and the default certificate validation helper are vulnerable to denial of service when opening a TLS connection to an attacker-controlled server for HTTPS. This is because unrecognized error values are mapped to NULL, but later code expects each error value to map to a valid error string. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-15049\nCVE-Crit: HIGH\nCVE-DESC: An issue was found in http / ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. Request Smuggling and Poisoning attack can be successful against an HTTP cache. The client sends an HTTP request with a Content-Length header containing \"+ \\\"-\"or an unusual shell space character prefix to the length field value. \nCVE-STATUS: Default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-24606\nCVE-Crit: HIGH\nCVE-DESC: Squid before 4.13 and 5.x before 5.0.4 allows a trusted partner to perform a denial of service using all available CPU cycles while processing a generated Cache Digest response message. This only occurs when cache_peer is used with the cache digests function. The problem exists because the livelocking peerDigestHandleReply () in peer_digest.cc does not handle EOF correctly. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-25097\nCVE-Crit: HIGH\nCVE-DESC: An issue was found in Squid prior to versions 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to smuggle HTTP requests and access services that are otherwise denied by security controls. This occurs for certain uri_whitespace configuration settings. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-8517\nCVE-Crit: HIGH\nCVE-DESC: An issue was discovered in Squid before 4.10. Due to improper input validation, the NTLM authentication credential parser in ext_lm_group_acl can write to memory outside of the credential buffer. On systems with memory access protection, this can cause an auxiliary process to terminate unexpectedly. This results in Squid process termination and denial of service for all clients using the proxy. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-8450\nCVE-Crit: HIGH\nCVE-DESC: An issue was discovered in Squid before 4.10. Due to improper buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2020-8449\nCVE-Crit: HIGH\nCVE-DESC: An issue was discovered in Squid before 4.10. Due to improper input validation, it can interpret generated HTTP requests in unexpected ways to access server resources denied by earlier security filters. \nCVE-STATUS: default\nCVE-REV: default\n \n \nCVE-ID: CVE-2021-28116\nCVE-Crit: MEDIUM\nCVE-DESC: Squid prior to versions 4.14 and 5.x through 5.0.5 in some configurations allows information disclosure due to WCCP protocol data being read out of bounds. This can be used as part of a chain to remotely execute code like nobody. \nCVE-STATUS: default\nCVE-REV: default\n \n\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-07-02T18:10:45", "type": "rosalinux", "title": "Advisory ROSA-SA-2021-1976", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-10003", "CVE-2018-19131", "CVE-2018-19132", "CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12522", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-15810", "CVE-2020-15811", "CVE-2020-24606", "CVE-2020-25097", "CVE-2020-8449", "CVE-2020-8450", "CVE-2020-8517", "CVE-2021-28116"], "modified": "2021-07-02T18:10:45", "id": "ROSA-SA-2021-1976", "href": "https://abf.rosalinux.ru/advisories/ROSA-SA-2021-1976", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "avleonov": [{"lastseen": "2020-08-30T20:06:45", "description": "This time I would like to review not only the vulnerabilities that were published in the last August Microsoft Patch Tuesday, but also the CVEs that were published on other, not Patch Tuesday, days. Of course, if there are any.\n\n\n\nBut let&#x27;s start with the vulnerabilities that were presented on MS Patch Tuesday on August 11th. There were 120 vulnerabilities: 17 of them are Critical and 103 Important. My [vulristics script](<https://github.com/leonov-av/vulristics/blob/master/report_ms_patch_tuesday_exploits.py>) could not find public exploits for these vulnerabilities on Vulners.com.\n\nFor the first time in a long time, there were 2 Exploitation Detected vulnerabilities.\n\n### Exploitation detected (2)\n\n#### Remote Code Execution\n\n * Internet Explorer ([CVE-2020-1380](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1380>))\n\n#### Spoofing\n\n * Windows ([CVE-2020-1464](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464>))\n\nWindows spoofing ([CVE-2020-1464](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464>)) is good for phishing. &quot;In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded.&quot;\n\nRCE in Internet Explorer ([CVE-2020-1380](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1380>)) might be interesting in the context of &quot;An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the IE rendering engine&quot;. \n\n### Exploitation more likely (8)\n\n#### Remote Code Execution\n\n * Internet Explorer ([CVE-2020-1570](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1570>))\n * MSHTML Engine ([CVE-2020-1567](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1567>))\n\n#### Elevation of Privilege\n\n * Windows Ancillary Function Driver for WinSock ([CVE-2020-1587](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1587>))\n * Windows GDI ([CVE-2020-1480](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1480>), [CVE-2020-1529](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1529>))\n * Windows Kernel ([CVE-2020-1566](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1566>))\n * Windows dnsrslvr.dll ([CVE-2020-1584](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1584>))\n\n#### Information Disclosure\n\n * Windows Kernel ([CVE-2020-1578](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1578>))\n\nFor some reason, all VM vendors ignored Exploitation more likely vulnerabilities this time. Although RCE in Internet Explorer ([CVE-2020-1570](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1570>)) and MSHTML Engine ([CVE-2020-1567](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1567>)) may be interesting.\n\n### Other Product based (31)\n\n#### Media Foundation\n\n * Memory Corruption ([CVE-2020-1478](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1478>), [CVE-2020-1379](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1379>), [CVE-2020-1477](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1477>), [CVE-2020-1492](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1492>), [CVE-2020-1525](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1525>), [CVE-2020-1554](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1554>))\n * Information Disclosure ([CVE-2020-1487](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1487>))\n\n#### Microsoft Excel\n\n * Remote Code Execution ([CVE-2020-1494](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1494>), [CVE-2020-1495](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1495>), [CVE-2020-1496](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1496>), [CVE-2020-1498](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1498>), [CVE-2020-1504](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1504>))\n * Information Disclosure ([CVE-2020-1497](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1497>))\n\n#### Microsoft SharePoint\n\n * Information Disclosure ([CVE-2020-1505](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1505>))\n * Cross Site Scripting ([CVE-2020-1573](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1573>), [CVE-2020-1580](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1580>))\n * Spoofing ([CVE-2020-1499](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1499>), [CVE-2020-1500](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1500>), [CVE-2020-1501](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1501>))\n\n#### Windows Backup Engine\n\n * Elevation of Privilege ([CVE-2020-1535](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1535>), [CVE-2020-1536](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1536>), [CVE-2020-1539](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1539>), [CVE-2020-1540](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1540>), [CVE-2020-1541](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1541>), [CVE-2020-1542](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1542>), [CVE-2020-1543](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1543>), [CVE-2020-1544](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1544>), [CVE-2020-1545](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1545>), [CVE-2020-1546](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1546>), [CVE-2020-1547](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1547>), [CVE-2020-1551](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1551>))\n\nThis time, the products with the most vulnerabilities are Media Foundation, Microsoft Excel, Microsoft SharePoint and Windows Backup Engine. VM vendors pay attention to Memory Corruption (in fact RCE) in Media Foundation, RCE in Microsoft Excel and Elevation of Privilege in Windows Backup Engine.\n\n### Other Vulnerability Type based (79)\n\n#### Remote Code Execution\n\n * .NET Framework ([CVE-2020-1046](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1046>))\n * Jet Database Engine ([CVE-2020-1473](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1473>), [CVE-2020-1557](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1557>), [CVE-2020-1558](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1558>), [CVE-2020-1564](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1564>))\n * Microsoft Access ([CVE-2020-1582](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1582>))\n * Microsoft Edge ([CVE-2020-1569](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1569>))\n * Microsoft Edge PDF ([CVE-2020-1568](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1568>))\n * Microsoft Graphics Components ([CVE-2020-1561](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1561>), [CVE-2020-1562](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1562>))\n * Microsoft Office ([CVE-2020-1563](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1563>))\n * Microsoft Outlook ([CVE-2020-1483](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1483>))\n * Microsoft Windows Codecs Library ([CVE-2020-1560](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1560>), [CVE-2020-1574](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1574>), [CVE-2020-1585](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1585>))\n * Scripting Engine ([CVE-2020-1555](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1555>))\n * Visual Studio Code ([CVE-2020-0604](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0604>))\n * Windows Font Driver Host ([CVE-2020-1520](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1520>))\n * Windows Media ([CVE-2020-1339](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1339>))\n\n#### Denial of Service\n\n * ASP.NET Core ([CVE-2020-1597](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1597>))\n * Microsoft SQL Server Management Studio ([CVE-2020-1455](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1455>))\n * Windows Remote Desktop Gateway (RD Gateway) ([CVE-2020-1466](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1466>))\n\n#### Elevation of Privilege\n\n * ASP.NET and .NET ([CVE-2020-1476](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1476>))\n * Connected User Experiences and Telemetry Service ([CVE-2020-1511](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1511>))\n * DirectX ([CVE-2020-1479](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1479>))\n * Local Security Authority Subsystem Service ([CVE-2020-1509](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1509>))\n * Microsoft Office Click-to-Run ([CVE-2020-1581](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1581>))\n * Netlogon ([CVE-2020-1472](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472>))\n * Windows ([CVE-2020-1565](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1565>))\n * Windows Accounts Control ([CVE-2020-1531](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1531>))\n * Windows AppX Deployment Extensions ([CVE-2020-1488](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1488>))\n * Windows Backup Service ([CVE-2020-1534](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1534>))\n * Windows CDP User Components ([CVE-2020-1549](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1549>), [CVE-2020-1550](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1550>))\n * Windows CSC Service ([CVE-2020-1489](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1489>), [CVE-2020-1513](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1513>))\n * Windows Custom Protocol Engine ([CVE-2020-1527](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1527>))\n * Windows File Server Resource Management Service ([CVE-2020-1517](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1517>), [CVE-2020-1518](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1518>))\n * Windows Function Discovery SSDP Provider ([CVE-2020-1579](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1579>))\n * Windows Hard Link ([CVE-2020-1467](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1467>))\n * Windows Kernel ([CVE-2020-1417](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1417>), [CVE-2020-1486](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1486>))\n * Windows Network Connection Broker ([CVE-2020-1526](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1526>))\n * Windows Print Spooler ([CVE-2020-1337](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337>))\n * Windows Radio Manager API ([CVE-2020-1528](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1528>))\n * Windows Registry ([CVE-2020-1377](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1377>), [CVE-2020-1378](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1378>))\n * Windows Remote Access ([CVE-2020-1530](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1530>), [CVE-2020-1537](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1537>))\n * Windows Runtime ([CVE-2020-1553](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1553>))\n * Windows Server Resource Management Service ([CVE-2020-1475](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1475>))\n * Windows Setup ([CVE-2020-1571](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1571>))\n * Windows Speech Runtime ([CVE-2020-1521](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1521>), [CVE-2020-1522](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1522>))\n * Windows Speech Shell Components ([CVE-2020-1524](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1524>))\n * Windows Storage Service ([CVE-2020-1490](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1490>))\n * Windows Telephony Server ([CVE-2020-1515](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1515>))\n * Windows UPnP Device Host ([CVE-2020-1519](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1519>), [CVE-2020-1538](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1538>))\n * Windows WalletService ([CVE-2020-1533](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1533>), [CVE-2020-1556](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1556>))\n * Windows Work Folder Service ([CVE-2020-1552](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1552>))\n * Windows Work Folders Service ([CVE-2020-1470](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1470>), [CVE-2020-1484](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1484>), [CVE-2020-1516](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1516>))\n\n#### Information Disclosure\n\n * DirectWrite ([CVE-2020-1577](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1577>))\n * Microsoft Outlook ([CVE-2020-1493](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1493>))\n * Microsoft Word ([CVE-2020-1502](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1502>), [CVE-2020-1503](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1503>), [CVE-2020-1583](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1583>))\n * Windows ARM ([CVE-2020-1459](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1459>))\n * Windows Image Acquisition Service ([CVE-2020-1474](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1474>), [CVE-2020-1485](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1485>))\n * Windows Kernel ([CVE-2020-1510](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1510>))\n * Windows RRAS Service ([CVE-2020-1383](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1383>))\n * Windows State Repository Service ([CVE-2020-1512](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1512>))\n * Windows WaasMedic Service ([CVE-2020-1548](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1548>))\n\n#### Cross Site Scripting\n\n * Microsoft Dynamics 365 (On-Premise) ([CVE-2020-1591](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1591>))\n\nIf we look at the rest of the vulnerabilities, the most interesting are RCEs in Jet Database Engine ([CVE-2020-1473](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1473>), [CVE-2020-1557](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1557>), [CVE-2020-1558](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1558>), [CVE-2020-1564](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1564>)), Microsoft Edge PDF ([CVE-2020-1568](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1568>)), Microsoft Windows Codecs Library ([CVE-2020-1560](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1560>), [CVE-2020-1574](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1574>), [CVE-2020-1585](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1585>)) and Windows Media ([CVE-2020-1339](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1339>)). \n\nThe second block is Elevation of Privilege in Local Security Authority Subsystem Service (LSASS) ([CVE-2020-1509](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1509>)), Windows Print Spooler ([CVE-2020-1337](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337>)) and Netlogon ([CVE-2020-1472](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472>)). For the last one &quot;an unauthenticated attacker could use MS-NRPC to connect to a domain controller as a domain administrator&quot;.\n\n## Other vulnerabilities\n\nNow let&#x27;s take a look at the vulnerabilities that were released from 07/15/2020 to 08/27/2020 excluding the August Patch Tuesday. I added support for such exceptions in report_ms_patch_tuesday.py in Vulristics. In fact, there were very few CVE vulnerabilities outside the Patch Tuesday.\n\n### Other Vulnerability Type based (2)\n\n#### Remote Code Execution\n\n * Microsoft Dynamics 365 for Finance and Operations (on-premises) ([CVE-2020-1182](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1182>))\n\n#### Elevation of Privilege\n\n * Microsoft Edge (Chromium-based) ([CVE-2020-1341](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1341>))\n\nRCE in on-premises Microsoft Dynamics 365 for Finance and Operations. &quot;An authenticated attacker with privileges to import and export data could exploit this vulnerability by sending a specially crafted file to a vulnerable Dynamics server&quot;.\n\nElevation of Privilege in Microsoft Edge. &quot;To exploit the vulnerability, the user must browse to a malicious website that is design to download a DLL file and click on the page to being the process&quot;. But this vulnerability is surprisingly low-critical, only Moderate.\n\nYou may have heard about Microsoft unscheduled update to Windows Remote Access Elevation of Privilege released August 20. But it was about the same vulnerabilities ([CVE-2020-1530](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1530>), [CVE-2020-1537](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1537>)) that were presented in August Patch Tuesday, but fixes this vulnerability for older OS versions: Windows 8.1, RT 8.1, and Server 2012 R2.\n\n", "edition": 2, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-08-30T22:13:56", "type": "avleonov", "title": "Microsoft Patch Tuesday August 2020: vulnerabilities with Detected Exploitation, useful for phishing and others", "bulletinFamily": "blog", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0604", "CVE-2020-1046", "CVE-2020-1182", "CVE-2020-1337", "CVE-2020-1339", "CVE-2020-1341", "CVE-2020-1377", "CVE-2020-1378", "CVE-2020-1379", "CVE-2020-1380", "CVE-2020-1383", "CVE-2020-1417", "CVE-2020-1455", "CVE-2020-1459", "CVE-2020-1464", "CVE-2020-1466", "CVE-2020-1467", "CVE-2020-1470", "CVE-2020-1472", "CVE-2020-1473", "CVE-2020-1474", "CVE-2020-1475", "CVE-2020-1476", "CVE-2020-1477", "CVE-2020-1478", "CVE-2020-1479", "CVE-2020-1480", "CVE-2020-1483", "CVE-2020-1484", "CVE-2020-1485", "CVE-2020-1486", "CVE-2020-1487", "CVE-2020-1488", "CVE-2020-1489", "CVE-2020-1490", "CVE-2020-1492", "CVE-2020-1493", "CVE-2020-1494", "CVE-2020-1495", "CVE-2020-1496", "CVE-2020-1497", "CVE-2020-1498", "CVE-2020-1499", "CVE-2020-1500", "CVE-2020-1501", "CVE-2020-1502", "CVE-2020-1503", "CVE-2020-1504", "CVE-2020-1505", "CVE-2020-1509", "CVE-2020-1510", "CVE-2020-1511", "CVE-2020-1512", "CVE-2020-1513", "CVE-2020-1515", "CVE-2020-1516", "CVE-2020-1517", "CVE-2020-1518", "CVE-2020-1519", "CVE-2020-1520", "CVE-2020-1521", "CVE-2020-1522", "CVE-2020-1524", "CVE-2020-1525", "CVE-2020-1526", "CVE-2020-1527", "CVE-2020-1528", "CVE-2020-1529", "CVE-2020-1530", "CVE-2020-1531", "CVE-2020-1533", "CVE-2020-1534", "CVE-2020-1535", "CVE-2020-1536", "CVE-2020-1537", "CVE-2020-1538", "CVE-2020-1539", "CVE-2020-1540", "CVE-2020-1541", "CVE-2020-1542", "CVE-2020-1543", "CVE-2020-1544", "CVE-2020-1545", "CVE-2020-1546", "CVE-2020-1547", "CVE-2020-1548", "CVE-2020-1549", "CVE-2020-1550", "CVE-2020-1551", "CVE-2020-1552", "CVE-2020-1553", "CVE-2020-1554", "CVE-2020-1555", "CVE-2020-1556", "CVE-2020-1557", "CVE-2020-1558", "CVE-2020-1560", "CVE-2020-1561", "CVE-2020-1562", "CVE-2020-1563", "CVE-2020-1564", "CVE-2020-1565", "CVE-2020-1566", "CVE-2020-1567", "CVE-2020-1568", "CVE-2020-1569", "CVE-2020-1570", "CVE-2020-1571", "CVE-2020-1573", "CVE-2020-1574", "CVE-2020-1577", "CVE-2020-1578", "CVE-2020-1579", "CVE-2020-1580", "CVE-2020-1581", "CVE-2020-1582", "CVE-2020-1583", "CVE-2020-1584", "CVE-2020-1585", "CVE-2020-1587", "CVE-2020-1591", "CVE-2020-1597"], "modified": "2020-08-30T22:13:56", "id": "AVLEONOV:F17F36C3CC642EBDC27E43900FE3905E", "href": "http://feedproxy.google.com/~r/avleonov/~3/shc67E2GAnY/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}]}