logo
DATABASE RESOURCES PRICING ABOUT US

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 : Squid vulnerabilities (USN-4895-1)

Description

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4895-1 advisory. - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing +\ - or an uncommon shell whitespace character prefix to the length field-value. (CVE-2020-15049) - An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings. (CVE-2020-25097) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.


Related