Package "squid-cgi"
| Name: |
squid-cgi
|
Description: |
Full featured Web Proxy cache (HTTP proxy) - control CGI
|
| Latest version: |
3.5.27-1ubuntu1.14 |
| Release: |
bionic (18.04) |
| Level: |
security |
| Repository: |
universe |
| Head package: |
squid3 |
| Homepage: |
http://www.squid-cache.org |
Links
Download "squid-cgi"
Other versions of "squid-cgi" in Bionic
Changelog
|
squid3 (3.5.27-1ubuntu1.9) bionic-security; urgency=medium
* SECURITY UPDATE: Request Smuggling and Poisoning issue
- debian/patches/CVE-2020-15049.patch: validate Content-Length value
prefix in src/http/ContentLengthInterpreter.cc,
src/http/ContentLengthInterpreter.h.
- CVE-2020-15049
* SECURITY UPDATE: HTTP Request Smuggling issue
- debian/patches/CVE-2020-15810.patch: enforce token characters for
field-name in src/HttpHeader.cc.
- CVE-2020-15810
* SECURITY UPDATE: HTTP Request Splitting issue
- debian/patches/CVE-2020-15811-pre.patch: validate Content-Length
header values in src/HttpHeader.cc, src/HttpHeaderTools.cc,
src/HttpHeaderTools.h, src/http/ContentLengthInterpreter.cc,
src/http/ContentLengthInterpreter.h, src/http/Makefile.am.
- debian/patches/CVE-2020-15811.patch: Improve Transfer-Encoding
handling in src/HttpHeader.cc, src/HttpHeader.h, src/client_side.cc,
src/http.cc.
- CVE-2020-15811
* SECURITY UPDATE: DoS via peer crafted Cache Digest response message
- debian/patches/CVE-2020-24606.patch: fix livelocking in
peerDigestHandleReply in src/peer_digest.cc.
- CVE-2020-24606
* Enable the test suite
- debian/rules: enable test suite
- debian/patches/enable-the-test-suite.patch: fix FTBFS.
- debain/patches/fix-cppunit-detection.patch: don't use cppunit-config
which is no longer available in bionic.
-- Marc Deslauriers <email address hidden> Wed, 02 Sep 2020 11:35:51 -0400
|
| Source diff to previous version |
| CVE-2020-15049 |
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can s |
| CVE-2020-15810 |
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed again |
| CVE-2020-15811 |
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed again |
| CVE-2020-24606 |
Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a |
|
|
squid3 (3.5.27-1ubuntu1.8) bionic-security; urgency=medium
* SECURITY REGRESSION: regression when parsing icap and ecap protocols
(LP: #1890265)
- debian/patches/CVE-2019-12523-bug965012.patch
* Thanks to Markus Koschany for the regression fix!
-- Marc Deslauriers <email address hidden> Tue, 25 Aug 2020 13:12:13 -0400
|
| Source diff to previous version |
| 1890265 |
BUG: Version 3.5.27-1ubuntu1.7 breaks config using icap |
| CVE-2019-12523 |
An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through |
|
|
squid3 (3.5.27-1ubuntu1.7) bionic-security; urgency=medium
* SECURITY UPDATE: Multiple Issues in HTTP Request processing
- debian/patches/CVE-2019-12520.patch: properly handle userinfo in
src/url.cc.
- CVE-2019-12520
- CVE-2019-12524
* SECURITY UPDATE: Multiple issues in URI processing
- debian/patches/CVE-2019-12526.patch: replace patch with the one from
Debian to get backported functions.
- debian/patches/CVE-2019-12523.patch: update URI parser to use SBuf
parsing APIs.
- CVE-2019-12523
- CVE-2019-18676
* Thanks to Markus Koschany for the backports this update is based on.
-- Marc Deslauriers <email address hidden> Tue, 28 Jul 2020 12:38:51 -0400
|
| Source diff to previous version |
| CVE-2019-12520 |
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does th |
| CVE-2019-12524 |
An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid |
| CVE-2019-12526 |
An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a rem |
| CVE-2019-12523 |
An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through |
| CVE-2019-18676 |
An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in |
|
|
squid3 (3.5.27-1ubuntu1.6) bionic-security; urgency=medium
* SECURITY UPDATE: multiple ESI issues
- debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
src/esi/Esi.h, src/esi/Expression.cc.
- CVE-2019-12519
- CVE-2019-12521
* SECURITY UPDATE: hostname parameter mishandling in cachemgr.cgi
- debian/patches/CVE-2019-18860.patch: add validation for hostname
parameter in src/base/CharacterSet.cc, tools/Makefile.am,
tools/cachemgr.cc.
- CVE-2019-18860
* SECURITY UPDATE: Digest Authentication nonce replay issue
- debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
overflow in src/auth/digest/Config.cc.
- CVE-2020-11945
-- Marc Deslauriers <email address hidden> Thu, 07 May 2020 10:03:32 -0400
|
| Source diff to previous version |
| CVE-2019-12519 |
An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function |
| CVE-2019-12521 |
An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for ho |
| CVE-2019-18860 |
Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. |
| CVE-2020-11945 |
An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that ar |
|
|
squid3 (3.5.27-1ubuntu1.5) bionic-security; urgency=medium
* SECURITY UPDATE: info disclosure via FTP server
- debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
src/clients/FtpGateway.cc.
- CVE-2019-12528
* SECURITY UPDATE: incorrect input validation and buffer management
- debian/patches/CVE-2020-84xx-1.patch: ignore malformed Host header in
intercept and reverse proxy mode in src/client_side.cc.
- debian/patches/CVE-2020-84xx-2.patch: fix request URL generation in
reverse proxy configurations in src/client_side.cc.
- debian/patches/CVE-2020-84xx-3.patch: fix security patch in
src/client_side.cc.
- CVE-2020-8449
- CVE-2020-8450
* SECURITY UPDATE: DoS in NTLM authentication
- debian/patches/CVE-2020-8517.patch: improved username handling in
helpers/external_acl/LM_group/ext_lm_group_acl.cc.
- CVE-2020-8517
-- Marc Deslauriers <email address hidden> Wed, 19 Feb 2020 12:50:27 -0500
|
| CVE-2019-12528 |
An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as |
| CVE-2020-8449 |
An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access |
| CVE-2020-8450 |
An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance act |
| CVE-2020-8517 |
An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may w |
|
About
-
Send Feedback to @ubuntu_updates
