CVE-2019-18679

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

• squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

• squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

• squid: Improper input validation in URI processor (CVE-2019-12523)

• squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

• squid: Heap overflow issue in URN processing (CVE-2019-12526)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

• squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

• squid: Buffer overflow in URI processor (CVE-2019-18676)

• squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

• squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

• squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

• squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: DoS in TLS handshake (CVE-2020-14058)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

• squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

• squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

• squid: Improper input validation in URI processor (CVE-2019-12523)

• squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

• squid: Heap overflow issue in URN processing (CVE-2019-12526)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

• squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

• squid: Buffer overflow in URI processor (CVE-2019-18676)

• squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

• squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

• squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

• squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: DoS in TLS handshake (CVE-2020-14058)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

Potential remote code execution during URN processing (CVE-2019-12526).

Multiple improper validations in URI processing (CVE-2019-12523, CVE-2019-18676).

Cross-Site Request Forgery in HTTP Request processing (CVE-2019-18677).

Incorrect message parsing which could have led to HTTP request splitting issue (CVE-2019-18678).

Information disclosure when processing HTTP Digest Authentication (CVE-2019-18679).

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressesd:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

This update for squid fixes the following issues:

• CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).
• CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).

This update for squid3 fixes the following issues:

• Fixed a Cache Poisoning and Request Smuggling attack (CVE-2020-15049, bsc#1173455)

• Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (CVE-2019-12519, CVE-2019-12521, bsc#1169659)

• Fixed handling of hostname in cachemgr.cgi (CVE-2019-18860, bsc#1167373)

• Fixed a potential remote execution vulnerability when using HTTP Digest Authentication (CVE-2020-11945, bsc#1170313)

• Fixed a potential ACL bypass, cache-bypass and cross-site scripting attack when processing invalid HTTP Request messages (CVE-2019-12520, CVE-2019-12524, bsc#1170423)

• Fixed a potential denial of service when processing TLS certificates during HTTPS connections (CVE-2020-14059, bsc#1173304)

• Fixed a potential denial of service associated with incorrect buffer management of HTTP Basic Authentication credentials (bsc#1141329, CVE-2019-12529)

• Fixed an incorrect buffer management resulting in vulnerability to a denial of service during processing of HTTP Digest Authentication credentials (bsc#1141332, CVE-2019-12525)

• Fix XSS via user_name or auth parameter in cachemgr.cgi (bsc#1140738, CVE-2019-13345)

• Fixed a potential code execution vulnerability (CVE-2019-12526, bsc#1156326)

• Fixed HTTP Request Splitting in HTTP message processing and information disclosure in HTTP Digest Authentication (CVE-2019-18678, CVE-2019-18679, bsc#1156323, bsc#1156324)

• Fixed a security issue allowing a remote client ability to cause use a buffer overflow when squid is acting as reverse-proxy. (CVE-2020-8449, CVE-2020-8450, bsc#1162687)

• Fixed a security issue allowing for information disclosure in FTP gateway (CVE-2019-12528, bsc#1162689)

• Fixed a security issue in ext_lm_group_acl when processing NTLM Authentication credentials. (CVE-2020-8517, bsc#1162691)

• Fixed Cross-Site Request Forgery in HTTP Request processing (CVE-2019-18677, bsc#1156328)

• Disable urn parsing and parsing of unknown schemes (bsc#1156329, CVE-2019-12523, CVE-2019-18676)

Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain URN requests. A remote attacker could possibly use this issue to bypass access checks and access restricted servers. This issue was only addressed in Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-12523)

Jeriko One discovered that Squid incorrectly handed URN responses. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12526)

Alex Rousskov discovered that Squid incorrectly handled certain strings. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 19.04. (CVE-2019-12854)

Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain input. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue was only addressed in Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-18676)

Kristoffer Danielsson discovered that Squid incorrectly handled certain messages. This issue could result in traffic being redirected to origins it should not be delivered to. (CVE-2019-18677)

Régis Leroy discovered that Squid incorrectly handled certain HTTP request headers. A remote attacker could use this to smuggle HTTP requests and corrupt caches with arbitrary content. (CVE-2019-18678)

David Fifield discovered that Squid incorrectly handled HTTP Digest Authentication. A remote attacker could possibly use this issue to obtain pointer contents and bypass ASLR protections. (CVE-2019-18679)