CVE-2020-14059

This update for squid fixes the following issues:

squid was updated to version 4.12

Security issue fixed:

• CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake (bsc#1173304).

Other issues addressed:

• Reverted to slow search for new SMP shm pages due to a regression
• Fixed an issue where negative responses were never cached
• Fixed stall if transaction was overwriting a recently active cache entry

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

This update for squid3 fixes the following issues:

• Fixed a Cache Poisoning and Request Smuggling attack (CVE-2020-15049, bsc#1173455)

• Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (CVE-2019-12519, CVE-2019-12521, bsc#1169659)

• Fixed handling of hostname in cachemgr.cgi (CVE-2019-18860, bsc#1167373)

• Fixed a potential remote execution vulnerability when using HTTP Digest Authentication (CVE-2020-11945, bsc#1170313)

• Fixed a potential ACL bypass, cache-bypass and cross-site scripting attack when processing invalid HTTP Request messages (CVE-2019-12520, CVE-2019-12524, bsc#1170423)

• Fixed a potential denial of service when processing TLS certificates during HTTPS connections (CVE-2020-14059, bsc#1173304)

• Fixed a potential denial of service associated with incorrect buffer management of HTTP Basic Authentication credentials (bsc#1141329, CVE-2019-12529)

• Fixed an incorrect buffer management resulting in vulnerability to a denial of service during processing of HTTP Digest Authentication credentials (bsc#1141332, CVE-2019-12525)

• Fix XSS via user_name or auth parameter in cachemgr.cgi (bsc#1140738, CVE-2019-13345)

• Fixed a potential code execution vulnerability (CVE-2019-12526, bsc#1156326)

• Fixed HTTP Request Splitting in HTTP message processing and information disclosure in HTTP Digest Authentication (CVE-2019-18678, CVE-2019-18679, bsc#1156323, bsc#1156324)

• Fixed a security issue allowing a remote client ability to cause use a buffer overflow when squid is acting as reverse-proxy. (CVE-2020-8449, CVE-2020-8450, bsc#1162687)

• Fixed a security issue allowing for information disclosure in FTP gateway (CVE-2019-12528, bsc#1162689)

• Fixed a security issue in ext_lm_group_acl when processing NTLM Authentication credentials. (CVE-2020-8517, bsc#1162691)

• Fixed Cross-Site Request Forgery in HTTP Request processing (CVE-2019-18677, bsc#1156328)

• Disable urn parsing and parsing of unknown schemes (bsc#1156329, CVE-2019-12523, CVE-2019-18676)

This update for squid fixes the following issues:

squid was updated to version 4.12

Security issue fixed:

• CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake (bsc#1173304).

Other issues addressed:

• Reverted to slow search for new SMP shm pages due to a regression
• Fixed an issue where negative responses were never cached
• Fixed stall if transaction was overwriting a recently active cache entry

This update for squid fixes the following issues:

squid was updated to version 4.12

Security issue fixed:

• CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake (bsc#1173304).

Other issues addressed:

• Reverted to slow search for new SMP shm pages due to a regression
• Fixed an issue where negative responses were never cached
• Fixed stall if transaction was overwriting a recently active cache entry

This update for squid fixes the following issues:

• CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake (bsc#1173304).
• CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).