Tinyproxy: Memory Disclosure

Background

Tinyproxy is a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems.

Description

Tinyproxy’s request processing does not sufficiently null-initialize variables used in error pages.

Impact

Contents of the Tinyproxy server’s memory could be disclosed via generated error pages.

Workaround

There is no known workaround at this time.

Resolution

All Tinyproxy users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-proxy/tinyproxy-1.11.1_p20220908"