CVE-2019-18860

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

• squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

• squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

• squid: Improper input validation in URI processor (CVE-2019-12523)

• squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

• squid: Heap overflow issue in URN processing (CVE-2019-12526)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

• squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

• squid: Buffer overflow in URI processor (CVE-2019-18676)

• squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

• squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

• squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

• squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: DoS in TLS handshake (CVE-2020-14058)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

• squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

• squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

• squid: Improper input validation in URI processor (CVE-2019-12523)

• squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

• squid: Heap overflow issue in URN processing (CVE-2019-12526)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

• squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

• squid: Buffer overflow in URI processor (CVE-2019-18676)

• squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

• squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

• squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

• squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: DoS in TLS handshake (CVE-2020-14058)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

This update for squid to version 4.11 fixes the following issues:

• CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).
• CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).
• CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).
• CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).
• CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

This update for squid to version 4.11 fixes the following issues:

• CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).
• CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).
• CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).
• CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).
• CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).

This update for squid to version 4.11 fixes the following issues:

• CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).
• CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).
• CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).
• CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).
• CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).

This update for squid3 fixes the following issues:

• Fixed a Cache Poisoning and Request Smuggling attack (CVE-2020-15049, bsc#1173455)

• Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (CVE-2019-12519, CVE-2019-12521, bsc#1169659)

• Fixed handling of hostname in cachemgr.cgi (CVE-2019-18860, bsc#1167373)

• Fixed a potential remote execution vulnerability when using HTTP Digest Authentication (CVE-2020-11945, bsc#1170313)

• Fixed a potential ACL bypass, cache-bypass and cross-site scripting attack when processing invalid HTTP Request messages (CVE-2019-12520, CVE-2019-12524, bsc#1170423)

• Fixed a potential denial of service when processing TLS certificates during HTTPS connections (CVE-2020-14059, bsc#1173304)

• Fixed a potential denial of service associated with incorrect buffer management of HTTP Basic Authentication credentials (bsc#1141329, CVE-2019-12529)

• Fixed an incorrect buffer management resulting in vulnerability to a denial of service during processing of HTTP Digest Authentication credentials (bsc#1141332, CVE-2019-12525)

• Fix XSS via user_name or auth parameter in cachemgr.cgi (bsc#1140738, CVE-2019-13345)

• Fixed a potential code execution vulnerability (CVE-2019-12526, bsc#1156326)

• Fixed HTTP Request Splitting in HTTP message processing and information disclosure in HTTP Digest Authentication (CVE-2019-18678, CVE-2019-18679, bsc#1156323, bsc#1156324)

• Fixed a security issue allowing a remote client ability to cause use a buffer overflow when squid is acting as reverse-proxy. (CVE-2020-8449, CVE-2020-8450, bsc#1162687)

• Fixed a security issue allowing for information disclosure in FTP gateway (CVE-2019-12528, bsc#1162689)

• Fixed a security issue in ext_lm_group_acl when processing NTLM Authentication credentials. (CVE-2020-8517, bsc#1162691)

• Fixed Cross-Site Request Forgery in HTTP Request processing (CVE-2019-18677, bsc#1156328)

• Disable urn parsing and parsing of unknown schemes (bsc#1156329, CVE-2019-12523, CVE-2019-18676)

This update for squid fixes the following issues:

• CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake (bsc#1173304).
• CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).

Jeriko One discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A malicious remote server could cause Squid to crash, possibly poison the cache, or possibly execute arbitrary code. (CVE-2019-12519, CVE-2019-12521)

It was discovered that Squid incorrectly handled the hostname parameter to cachemgr.cgi when certain browsers are used. A remote attacker could possibly use this issue to inject HTML or invalid characters in the hostname parameter. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2019-18860)

Clément Berthaux and Florian Guilbert discovered that Squid incorrectly handled Digest Authentication nonce values. A remote attacker could use this issue to replay nonce values, or possibly execute arbitrary code. (CVE-2020-11945)