Ubuntu.comUB:CVE-2018-19131CVE-2018-19131
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
40.0%
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S)
error page generation for certificate errors.
Bugs
Notes
| Author | Note |
|---|---|
| mdeslaur | squid in Ubuntu is not built with OpenSSL support, so Ubuntu isn’t actually vulnerable to this issue. |
References
www.squid-cache.org/Advisories/SQUID-2018_4.txt
www.squid-cache.org/Versions/v5/changesets/squid-5-6feeb15ff312f3e145763adf8d234ed6a0b3f11d.patch
github.com/squid-cache/squid/pull/306
launchpad.net/bugs/cve/CVE-2018-19131
nvd.nist.gov/vuln/detail/CVE-2018-19131
security-tracker.debian.org/tracker/CVE-2018-19131
www.cve.org/CVERecord?id=CVE-2018-19131
Related
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
40.0%