Published: 19/03/2021 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 8.6 | Impact Score: 4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

An issue exists in Squid up to and including 4.13 and 5.x up to and including 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.

Vulnerable Product	Search on Vulmon	Subscribe to Product
squid-cache squid
debian debian linux 10.0
fedoraproject fedora 32
fedoraproject fedora 33
fedoraproject fedora 34
netapp cloud manager -

Debian Bug report logs - #985068 squid: CVE-2020-25097: SQUID-2020:11 HTTP Request Smuggling Package: src:squid; Maintainer for src:squid is Luigi Gangitano <luigi@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 12 Mar 2021 13:09:02 UTC Severity: grave Tags: security, upstream Found in ...

Jianjun Chen discovered that the Squid proxy caching server was susceptible to HTTP request smuggling For the stable distribution (buster), this problem has been fixed in version 46-1+deb10u5 We recommend that you upgrade your squid packages For the detailed security status of squid please refer to its security tracker page at: security ...

A flaw was found in squid Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling This issue could allow a trusted client to perform an HTTP request smuggling attack and access services otherwise forbidden by squid The highest threat from this vulnerability is to data confidentiality (CVE-2020-250 ...

CWE-20 CWE-444 http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patch http://www.squid-cache.org/Versions/v5/changesets/SQUID-2020_11.patch https://github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6 https://www.debian.org/security/2021/dsa-4873 https://security.gentoo.org/glsa/202105-14 https://security.netapp.com/advisory/ntap-20210727-0010/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJMDRVV677AJL4BZAOLCT5LMFCGBZTC2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FBXFWKIGXPERDVQXG556LLPUOCMQGERC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RYBDMJCPYGOSURWDR3WJTE474UFT77/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985068 https://nvd.nist.gov https://www.debian.org/security/2021/dsa-4873

CVE-2020-25097

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect