CVE-2019-12529

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

• squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

• squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

• squid: Improper input validation in URI processor (CVE-2019-12523)

• squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

• squid: Heap overflow issue in URN processing (CVE-2019-12526)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

• squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

• squid: Buffer overflow in URI processor (CVE-2019-18676)

• squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

• squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

• squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

• squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: DoS in TLS handshake (CVE-2020-14058)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

• squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

• squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

• squid: Improper input validation in URI processor (CVE-2019-12523)

• squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

• squid: Heap overflow issue in URN processing (CVE-2019-12526)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

• squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

• squid: Buffer overflow in URI processor (CVE-2019-18676)

• squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

• squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

• squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

• squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: DoS in TLS handshake (CVE-2020-14058)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

Updated squid packages fix security vulnerabilities:

It was discovered that Squid incorrectly handled Digest authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2019-12525).

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2019-12529).

It was discovered that Squid incorrectly handled the cachemgr.cgi web module. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks (CVE-2019-13345).

Updated squid packages fix security vulnerabilities:

It was discovered that Squid incorrectly handled Digest authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2019-12525).

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2019-12527).

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2019-12529).

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it (CVE-2019-12854).

It was discovered that Squid incorrectly handled the cachemgr.cgi web module. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks (CVE-2019-13345).

The squid package has been updated to version 4.8, fixing these issues and other bugs.

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

This update for squid fixes the following issues:

Security issue fixed:

• CVE-2019-12529: Fixed a potential denial of service associated with HTTP Basic Authentication credentials (bsc#1141329).
• CVE-2019-12525: Fixed a denial of service during processing of HTTP Digest Authentication credentials (bsc#1141332).
• CVE-2019-13345: Fixed a cross site scripting vulnerability via user_name or auth parameter in cachemgr.cgi (bsc#1140738).

This update for squid fixes the following issues:

Security issue fixed:

• CVE-2019-12529: Fixed a potential denial of service associated with HTTP Basic Authentication credentials (bsc#1141329).
• CVE-2019-12525: Fixed a denial of service during processing of HTTP Digest Authentication credentials (bsc#1141332).
• CVE-2019-13345: Fixed a cross site scripting vulnerability via user_name or auth parameter in cachemgr.cgi (bsc#1140738).

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

This update for squid3 fixes the following issues:

• Fixed a Cache Poisoning and Request Smuggling attack (CVE-2020-15049, bsc#1173455)

• Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (CVE-2019-12519, CVE-2019-12521, bsc#1169659)

• Fixed handling of hostname in cachemgr.cgi (CVE-2019-18860, bsc#1167373)

• Fixed a potential remote execution vulnerability when using HTTP Digest Authentication (CVE-2020-11945, bsc#1170313)

• Fixed a potential ACL bypass, cache-bypass and cross-site scripting attack when processing invalid HTTP Request messages (CVE-2019-12520, CVE-2019-12524, bsc#1170423)

• Fixed a potential denial of service when processing TLS certificates during HTTPS connections (CVE-2020-14059, bsc#1173304)

• Fixed a potential denial of service associated with incorrect buffer management of HTTP Basic Authentication credentials (bsc#1141329, CVE-2019-12529)

• Fixed an incorrect buffer management resulting in vulnerability to a denial of service during processing of HTTP Digest Authentication credentials (bsc#1141332, CVE-2019-12525)

• Fix XSS via user_name or auth parameter in cachemgr.cgi (bsc#1140738, CVE-2019-13345)

• Fixed a potential code execution vulnerability (CVE-2019-12526, bsc#1156326)

• Fixed HTTP Request Splitting in HTTP message processing and information disclosure in HTTP Digest Authentication (CVE-2019-18678, CVE-2019-18679, bsc#1156323, bsc#1156324)

• Fixed a security issue allowing a remote client ability to cause use a buffer overflow when squid is acting as reverse-proxy. (CVE-2020-8449, CVE-2020-8450, bsc#1162687)

• Fixed a security issue allowing for information disclosure in FTP gateway (CVE-2019-12528, bsc#1162689)

• Fixed a security issue in ext_lm_group_acl when processing NTLM Authentication credentials. (CVE-2020-8517, bsc#1162691)

• Fixed Cross-Site Request Forgery in HTTP Request processing (CVE-2019-18677, bsc#1156328)

• Disable urn parsing and parsing of unknown schemes (bsc#1156329, CVE-2019-12523, CVE-2019-18676)

It was discovered that Squid incorrectly handled Digest authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2019-12525)

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.04. (CVE-2019-12527)

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2019-12529)