golang: HTTP request smuggling in net/http library

HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error the second field is ignored, and invalid fields are parsed as valid for example, "Content Length:" with a space in the...

golang: HTTP request smuggling in net/http library

HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error the second field is ignored, and invalid fields are parsed as valid for example, "Content Length:" with a space in the...

golang: HTTP request smuggling in net/http library

HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error the second field is ignored, and invalid fields are parsed as valid for example, "Content Length:" with a space in the...

Debian Security Advisory DSA 3625-1 (squid3 - security update)

Several security issues have been discovered in the Squid caching proxy. CVE-2016-4051: CESG and Yuriy M. Kaminskiy discovered that Squid cachemgr.cgi was vulnerable to a buffer overflow when processing remotely supplied inputs relayed through Squid. CVE-2016-4052: CESG discovered that a buffer...

[SECURITY] [DLA 558-1] squid security update

Package : squid Version : 2.7.STABLE9-4.1+deb7u2 CVE ID : CVE-2016-4554 A security issue has been discovered in the Squid chaching proxy, on its 2.7.STABLE9 version branch. CVE-2016-4554 Jianjun Chen found that Squid was vulnerable to a header smuggling attack that could lead to cache poisoning a...

Debian DSA-3625-1 : squid3 - security update

Several security issues have been discovered in the Squid caching proxy. - CVE-2016-4051 : CESG and Yuriy M. Kaminskiy discovered that Squid cachemgr.cgi was vulnerable to a buffer overflow when processing remotely supplied inputs relayed through Squid. - CVE-2016-4052 : CESG discovered that a...

DLA-558-1 squid - security update

Bulletin has no description...

[SECURITY] [DSA 3625-1] squid3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3625-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 22, 2016 https://www.debian.org/security/faq -...

DSA-3625-1 squid3 - security update

Bulletin has no description...

Python urllib HTTP Header Injection

Python's built-in URL library "urllib2" in 2.x and "urllib" in 3.x is vulnerable to protocol stream injection attacks a.k.a. "smuggling" attacks via the http scheme. If an attacker could convince a Python application using this library to fetch an arbitrary URL, or fetch a resource from a malicio...

squid: Header Smuggling issue in HTTP Request processing

An input validation flaw was found in Squid's mimegetheaderfield function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid...

squid: Header Smuggling issue in HTTP Request processing

An input validation flaw was found in Squid's mimegetheaderfield function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid...

squid: Header Smuggling issue in HTTP Request processing

An input validation flaw was found in Squid's mimegetheaderfield function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid...

openSUSE Security Update : varnish (openSUSE-2016-588)

This varnish update to version 3.0.7 fixes the following issues : Security issues fixed : - CVE-2015-8852: Vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL. boo976097 Bugs fixed : - Stop recognizing a single CR \r as a HTTP line separator. - Improved error detection on...

DLA-478-1 squid3 - security update

Bulletin has no description...

MGASA-2016-0171 Updated squid packages fix security vulnerability

Due to incorrect data validation of intercepted HTTP Request messages Squid is vulnerable to clients bypassing the protection against CVE-2009-0801 related issues. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache...

Updated squid packages fix security vulnerability

Due to incorrect data validation of intercepted HTTP Request messages Squid is vulnerable to clients bypassing the protection against CVE-2009-0801 related issues. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache...

CVE-2016-4554

mimeheader.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue...

DEBIAN-CVE-2016-4554

mimeheader.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue...

CVE-2016-4554

CVE-2016-4554 affects Squid and is a header smuggling flaw in mime_get_header_field() that can bypass same-origin protections and enable cache poisoning when Squid acts as a reverse/interception proxy. Connected advisories describe concurrent issues (CVE-2016-4051/4052/4053/4054) in ESI processin...