(RHSA-2019:3476) Moderate: squid:4 security and bug fix update

2019-11-0517:50:00

access.redhat.com

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.949 High

EPSS

Percentile

99.3%

JSON

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

squid: XSS via user_name or auth parameter in cachemgr.cgi (CVE-2019-13345)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyx86_64squid-debuginfo< 4.4-8.module+el8.1.0+4044+36416a77squid-debuginfo-4.4-8.module+el8.1.0+4044+36416a77.x86_64.rpm
RedHatanyx86_64libecap-debuginfo< 1.0.1-2.module+el8.1.0+4044+36416a77libecap-debuginfo-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64.rpm
RedHatanyaarch64libecap< 1.0.1-2.module+el8.1.0+4044+36416a77libecap-1.0.1-2.module+el8.1.0+4044+36416a77.aarch64.rpm
RedHatanyaarch64squid-debugsource< 4.4-8.module+el8.1.0+4044+36416a77squid-debugsource-4.4-8.module+el8.1.0+4044+36416a77.aarch64.rpm
RedHatanys390xlibecap-debugsource< 1.0.1-2.module+el8.1.0+4044+36416a77libecap-debugsource-1.0.1-2.module+el8.1.0+4044+36416a77.s390x.rpm
RedHatanys390xlibecap-debuginfo< 1.0.1-2.module+el8.1.0+4044+36416a77libecap-debuginfo-1.0.1-2.module+el8.1.0+4044+36416a77.s390x.rpm
RedHatanys390xsquid-debugsource< 4.4-8.module+el8.1.0+4044+36416a77squid-debugsource-4.4-8.module+el8.1.0+4044+36416a77.s390x.rpm
RedHatanyppc64lesquid-debuginfo< 4.4-8.module+el8.1.0+4044+36416a77squid-debuginfo-4.4-8.module+el8.1.0+4044+36416a77.ppc64le.rpm
RedHatanyppc64lesquid< 4.4-8.module+el8.1.0+4044+36416a77squid-4.4-8.module+el8.1.0+4044+36416a77.ppc64le.rpm
RedHatanyppc64lelibecap-debuginfo< 1.0.1-2.module+el8.1.0+4044+36416a77libecap-debuginfo-1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	x86_64	squid-debuginfo	< 4.4-8.module+el8.1.0+4044+36416a77	squid-debuginfo-4.4-8.module+el8.1.0+4044+36416a77.x86_64.rpm
RedHat	any	x86_64	libecap-debuginfo	< 1.0.1-2.module+el8.1.0+4044+36416a77	libecap-debuginfo-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64.rpm
RedHat	any	aarch64	libecap	< 1.0.1-2.module+el8.1.0+4044+36416a77	libecap-1.0.1-2.module+el8.1.0+4044+36416a77.aarch64.rpm
RedHat	any	aarch64	squid-debugsource	< 4.4-8.module+el8.1.0+4044+36416a77	squid-debugsource-4.4-8.module+el8.1.0+4044+36416a77.aarch64.rpm
RedHat	any	s390x	libecap-debugsource	< 1.0.1-2.module+el8.1.0+4044+36416a77	libecap-debugsource-1.0.1-2.module+el8.1.0+4044+36416a77.s390x.rpm
RedHat	any	s390x	libecap-debuginfo	< 1.0.1-2.module+el8.1.0+4044+36416a77	libecap-debuginfo-1.0.1-2.module+el8.1.0+4044+36416a77.s390x.rpm
RedHat	any	s390x	squid-debugsource	< 4.4-8.module+el8.1.0+4044+36416a77	squid-debugsource-4.4-8.module+el8.1.0+4044+36416a77.s390x.rpm
RedHat	any	ppc64le	squid-debuginfo	< 4.4-8.module+el8.1.0+4044+36416a77	squid-debuginfo-4.4-8.module+el8.1.0+4044+36416a77.ppc64le.rpm
RedHat	any	ppc64le	squid	< 4.4-8.module+el8.1.0+4044+36416a77	squid-4.4-8.module+el8.1.0+4044+36416a77.ppc64le.rpm
RedHat	any	ppc64le	libecap-debuginfo	< 1.0.1-2.module+el8.1.0+4044+36416a77	libecap-debuginfo-1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le.rpm