5
CVSSv2

CVE-2020-8449

Published: 04/02/2020 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

An issue exists in Squid prior to 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

squid-cache squid

debian debian linux 9.0

debian debian linux 10.0

canonical ubuntu linux 16.04

canonical ubuntu linux 18.04

canonical ubuntu linux 19.10

opensuse leap 15.1

fedoraproject fedora 30

fedoraproject fedora 31

Vendor Advisories

Debian Bug report logs - #950802 squid: CVE-2020-8449 CVE-2020-8450 Package: src:squid; Maintainer for src:squid is Luigi Gangitano <luigi@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 6 Feb 2020 18:30:02 UTC Severity: important Tags: security, upstream Found in version squid/49-2 ...
Several security issues were fixed in Squid ...
Synopsis Important: squid security update Type/Severity Security Advisory: Important Topic An update for squid is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whi ...
Synopsis Moderate: squid:4 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for the squid:4 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability ...
Multiple security issues were discovered in the Squid proxy caching server, which could result in the bypass of security filters, information disclosure, the execution of arbitrary code or denial of service For the stable distribution (buster), these problems have been fixed in version 46-1+deb10u2 We recommend that you upgrade your squid packag ...
An issue was discovered in Squid before 410 It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes (CVE-2019-12528) An issue was discovered in http/ContentLengthInterpretercc in Squid before 412 and 5x before 503 A Requ ...