Published: 11/07/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

An issue exists in Squid 3.3.9 up to and including 3.5.28 and 4.x up to and including 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1.

Vulnerable Product	Search on Vulmon	Subscribe to Product
squid-cache squid
debian debian linux 8.0
debian debian linux 9.0
debian debian linux 10.0
opensuse leap 15.0
opensuse leap 15.1
fedoraproject fedora 29
canonical ubuntu linux 18.04
canonical ubuntu linux 19.04
canonical ubuntu linux 16.04
canonical ubuntu linux 12.04

Synopsis Important: squid:4 security update Type/Severity Security Advisory: Important Topic An update for the squid:4 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ...

Synopsis Important: squid security update Type/Severity Security Advisory: Important Topic An update for squid is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whi ...

Several security issues were fixed in Squid ...

Several vulnerabilities were discovered in Squid, a fully featured web proxy cache The flaws in the HTTP Digest Authentication processing, the HTTP Basic Authentication processing and in the cachemgrcgi allowed remote attackers to perform denial of service and cross-site scripting attacks, and potentially the execution of arbitrary code For the ...

An issue was discovered in Squid before 502 A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden This occurs because the attacker can overflow the nonce reference counter (a short integer) Remote code execution may occur if the pooled token credentials are freed (instead of ...

An issue was discovered in Squid through 47 When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate This function uses a fixed stack buffer to hold the expression while it's being evaluated When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack When adding ...

Impact: Moderate Public Date: 2019-07-12 CWE: CWE-119 Bugzilla: 1730535: CVE-2019-12525 squid: parsing ...

An issue was discovered in Squid before 49 When handling a URN request, a corresponding HTTP request is made This HTTP request doesn't go through the access checks that incoming HTTP requests go through This causes all access checks to be bypassed and allows access to restricted HTTP servers, eg, an attacker can connect to HTTP servers that o ...

A flaw was found in Squid through version 47 When handling the tag esi:when, when ESI is enabled, Squid calls the ESIExpression::Evaluate function which uses a fixed stack buffer to hold the expression While processing the expression, there is no check to ensure that the stack won't overflow The highest threat from this vulnerability is to data ...

CWE-787 http://www.squid-cache.org/Versions/v4/changesets/http://www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patch https://github.com/squid-cache/squid/commits/v4 https://usn.ubuntu.com/4065-1/https://lists.debian.org/debian-lts-announce/2019/07/msg00018.html https://usn.ubuntu.com/4065-2/https://www.debian.org/security/2019/dsa-4507 https://seclists.org/bugtraq/2019/Aug/42 http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2020:2041 https://usn.ubuntu.com/4065-1/

Get Started

CVE-2019-12525

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect