UbuntuUpdates.org

Package "squid"

Name: squid

Description:

Full featured Web Proxy cache (HTTP proxy GnuTLS flavour)
Latest version: 5.9-0ubuntu0.22.04.2
Release: jammy (22.04)
Level: updates
Repository: main
Homepage: http://www.squid-cache.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "squid"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "squid" in Jammy

Repository Area Version
base main 5.2-1ubuntu4
base universe 5.2-1ubuntu4
security main 5.9-0ubuntu0.22.04.2
security universe 5.9-0ubuntu0.22.04.2
updates universe 5.9-0ubuntu0.22.04.2

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 5.9-0ubuntu0.22.04.2 2024-07-22 13:07:03 UTC

  squid (5.9-0ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS in ESI processing using multi-byte characters
    - debian/patches/CVE-2024-37894.patch: fix variable datatype to handle
      variables names outside standard ASCII characters
    - CVE-2024-37894

 -- Vyom Yadav <email address hidden> Tue, 09 Jul 2024 15:49:37 +0530
Source diff to previous version
CVE-2024-37894 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid i

Version: 5.9-0ubuntu0.22.04.1 2024-07-04 22:07:06 UTC

  squid (5.9-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream version 5.9 (LP: #2040470):
    - mgr:index URL do not produce MGR_INDEX template
    - Block all non-localhost requests by default
    - Block to-localhost, to-link-local requests by default
    - ext_kerberos_ldap_group_acl: Support -b with -D
    - For a comprehensive list of changes, please see
      http://www.squid-cache.org/Versions/v5/ChangeLog.html.
  * Refresh patches:
    - d/p/0001-Default-configuration-file-for-debian.patch
    - d/p/CVE-{2023-5824-1,2024-25111}.patch
  * d/p/0001-Default-configuration-file-for-debian.patch: Comment
    disruptive upstream changes introduced because of upstream bug
    #5241.
  * d/NEWS: Write news entry regarding the decision to comment out the
    more strict defaults for connection to localhost and link-local
    networks.

 -- Sergio Durigan Junior <email address hidden> Wed, 03 Apr 2024 12:31:46 -0400
Source diff to previous version
2040470 Upstream microrelease of squid 5.9

Version: 5.7-0ubuntu0.22.04.4 2024-04-10 23:06:56 UTC

  squid (5.7-0ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via Cache Manager error responses
    - debian/patches/CVE-2024-23638.patch: just close after a write(2)
      response sending error in src/servers/Server.cc.
    - CVE-2024-23638
  * SECURITY UPDATE: DoS in HTTP header parsing
    - debian/patches/CVE-2024-25617.patch: improve handling of expanding
      HTTP header values in src/SquidString.h, src/cache_cf.cc,
      src/cf.data.pre, src/http.cc.
    - CVE-2024-25617
  * SECURITY UPDATE: DoS via chunked decoder uncontrolled recursion bug
    - debian/patches/CVE-2024-25111.patch: fix infinite recursion in
      src/SquidMath.h, src/http.cc, src/http.h.
    - CVE-2024-25111
  * SECURITY UPDATE: DoS via Improper Handling of Structural Elements bug
    - debian/patches/CVE-2023-5824-pre1.patch: break long store_client call
      chains with async calls.
    - debian/patches/CVE-2023-5824-pre2.patch: add Assure() as a
      replacement for problematic Must().
    - debian/patches/CVE-2023-5824-pre3.patch: fix compiler errors.
    - debian/patches/CVE-2023-5824-1.patch: remove serialized HTTP headers
      from storeClientCopy().
    - debian/patches/CVE-2023-5824-2.patch: fix frequent assertion.
    - debian/patches/CVE-2023-5824-3.patch: remove mem_hdr::freeDataUpto()
      assertion.
    - debian/patches/CVE-2023-5824-4.patch: fix Bug 5318.
    - CVE-2023-5824

 -- Marc Deslauriers <email address hidden> Thu, 14 Mar 2024 10:47:38 -0400
Source diff to previous version
CVE-2024-23638 Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack
CVE-2024-25617 Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may b
CVE-2024-25111 Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP C
CVE-2023-5824 Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug.

Version: 5.7-0ubuntu0.22.04.3 2024-01-23 05:11:13 UTC

  squid (5.7-0ubuntu0.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service in HTTP message processing
    - debian/patches/CVE-2023-49285.patch: additional parsing checks added to
      fix buffer overread in lib/rfc1123.c.
    - CVE-2023-49285
  * SECURITY UPDATE: denial of service in helper process management
    - debian/patches/CVE-2023-49286.patch: improved error handling included
      for helper process initialisation in src/ipc.cc.
    - CVE-2023-49286
  * SECURITY UPDATE: denial of service in HTTP request parsing
    - debian/patches/CVE-2023-50269.patch: limit x-forwarded-for hops and log
      limit as error when exceeded in src/ClientRequestContext.h,
      src/client_side_request.cc.
    - CVE-2023-50269

 -- Evan Caville <email address hidden> Wed, 17 Jan 2024 14:01:57 +1000
Source diff to previous version
CVE-2023-49285 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service a
CVE-2023-49286 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerabl
CVE-2023-50269 Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and version

Version: 5.7-0ubuntu0.22.04.2 2023-11-21 18:07:06 UTC

  squid (5.7-0ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS against certificate validation
    - debian/patches/CVE-2023-46724.patch: fix validation of certificates
      with CN=* in src/anyp/Uri.cc.
    - CVE-2023-46724
  * SECURITY UPDATE: DoS via Gopher gateway
    - debian/patches/CVE-2023-46728.patch: disable gopher support in
      src/FwdState.cc, src/HttpRequest.cc, src/IoStats.h, src/Makefile.am,
      src/adaptation/ecap/Host.cc, src/adaptation/ecap/MessageRep.cc,
      src/anyp/ProtocolType.h, src/anyp/Uri.cc, src/anyp/UriScheme.cc,
      src/client_side_request.cc, src/error/forward.h, src/http/Message.h,
      src/mgr/IoAction.cc, src/mgr/IoAction.h, src/stat.cc,
      src/tests/Stub.am.
    - CVE-2023-46728
  * SECURITY UPDATE: HTTP request smuggling, caused by chunked decoder
    lenience
    - debian/patches/CVE-2023-46846.patch: improve HTTP chunked encoding
      compliance in src/http/one/Parser.cc, src/http/one/Parser.h,
      src/http/one/TeChunkedParser.cc, src/parser/Tokenizer.cc,
      src/parser/Tokenizer.h.
    - CVE-2023-46846
  * SECURITY UPDATE: DoS via HTTP Digest Authentication
    - debian/patches/CVE-2023-46847.patch: fix stack buffer overflow when
      parsing Digest Authorization in src/auth/digest/Config.cc.
    - CVE-2023-46847
  * SECURITY UPDATE: DoS via ftp:// URLs
    - debian/patches/CVE-2023-46848.patch: fix userinfo percent-encoding in
      src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc,
      src/anyp/Uri.cc.
    - CVE-2023-46848

 -- Marc Deslauriers <email address hidden> Mon, 13 Nov 2023 09:20:05 -0500
CVE-2023-46724 Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4
CVE-2023-46728 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of
CVE-2023-46846 SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling pas
CVE-2023-46847 Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to he
CVE-2023-46848 Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ft


About   -   Send Feedback to @ubuntu_updates