CVE-2019-12528

An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

• squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

• squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

• squid: Improper input validation in URI processor (CVE-2019-12523)

• squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

• squid: Heap overflow issue in URN processing (CVE-2019-12526)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

• squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

• squid: Buffer overflow in URI processor (CVE-2019-18676)

• squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

• squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

• squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

• squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: DoS in TLS handshake (CVE-2020-14058)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

• squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

• squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

• squid: Improper input validation in URI processor (CVE-2019-12523)

• squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

• squid: Heap overflow issue in URN processing (CVE-2019-12526)

• squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

• squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

• squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

• squid: Buffer overflow in URI processor (CVE-2019-18676)

• squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

• squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

• squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

• squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

• squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

• squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

• squid: DoS in TLS handshake (CVE-2020-14058)

• squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

• squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
• CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
• CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
• CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
• CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
• CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
• CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
• CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
• CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
• CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
• CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
• CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
• CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

• CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
• CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
• CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
• CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
• CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
• CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
• CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
• CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
• CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
• CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
• CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads

Updated squid packages fix security vulnerabilities:

Jeriko One discovered that Squid incorrectly handled memory when connected to an FTP server. A remote attacker could possibly use this issue to obtain sensitive information from Squid memory (CVE-2019-12528).

Regis Leroy discovered that Squid incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to access server resources prohibited by earlier security filters (CVE-2020-8449).

Guido Vranken discovered that Squid incorrectly handled certain buffer operations when acting as a reverse proxy. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2020-8450).

Aaron Costello discovered that Squid incorrectly handled certain NTLM authentication credentials. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2020-8517).

This update for squid to version 4.10 fixes the following issues:

Security issues fixed:

• CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689).
• CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).

Non-security issue fixed:

• Improved cache handling with chunked responses.

This update was imported from the SUSE:SLE-15:Update update project.

This update for squid to version 4.10 fixes the following issues:

Security issues fixed:

• CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689).
• CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).

Non-security issue fixed:

• Improved cache handling with chunked responses.

This update was imported from the SUSE:SLE-15:Update update project.

This update for squid to version 4.11 fixes the following issues:

• CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).
• CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).
• CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).
• CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).
• CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

This update for squid to version 4.10 fixes the following issues:

Security issues fixed:

• CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689).
• CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).

Non-security issue fixed:

• Improved cache handling with chunked responses.

This update for squid to version 4.10 fixes the following issues:

Security issues fixed:

• CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689).
• CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).

Non-security issue fixed:

• Improved cache handling with chunked responses.

This update for squid fixes the following issues:

• CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).
• CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687).
• CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).

This update for squid to version 4.11 fixes the following issues:

• CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).
• CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).
• CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).
• CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).
• CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).

This update for squid to version 4.11 fixes the following issues:

• CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).
• CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).
• CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).
• CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).
• CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).

This update for squid3 fixes the following issues:

• Fixed a Cache Poisoning and Request Smuggling attack (CVE-2020-15049, bsc#1173455)

• Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (CVE-2019-12519, CVE-2019-12521, bsc#1169659)

• Fixed handling of hostname in cachemgr.cgi (CVE-2019-18860, bsc#1167373)

• Fixed a potential remote execution vulnerability when using HTTP Digest Authentication (CVE-2020-11945, bsc#1170313)

• Fixed a potential ACL bypass, cache-bypass and cross-site scripting attack when processing invalid HTTP Request messages (CVE-2019-12520, CVE-2019-12524, bsc#1170423)

• Fixed a potential denial of service when processing TLS certificates during HTTPS connections (CVE-2020-14059, bsc#1173304)

• Fixed a potential denial of service associated with incorrect buffer management of HTTP Basic Authentication credentials (bsc#1141329, CVE-2019-12529)

• Fixed an incorrect buffer management resulting in vulnerability to a denial of service during processing of HTTP Digest Authentication credentials (bsc#1141332, CVE-2019-12525)

• Fix XSS via user_name or auth parameter in cachemgr.cgi (bsc#1140738, CVE-2019-13345)

• Fixed a potential code execution vulnerability (CVE-2019-12526, bsc#1156326)

• Fixed HTTP Request Splitting in HTTP message processing and information disclosure in HTTP Digest Authentication (CVE-2019-18678, CVE-2019-18679, bsc#1156323, bsc#1156324)

• Fixed a security issue allowing a remote client ability to cause use a buffer overflow when squid is acting as reverse-proxy. (CVE-2020-8449, CVE-2020-8450, bsc#1162687)

• Fixed a security issue allowing for information disclosure in FTP gateway (CVE-2019-12528, bsc#1162689)

• Fixed a security issue in ext_lm_group_acl when processing NTLM Authentication credentials. (CVE-2020-8517, bsc#1162691)

• Fixed Cross-Site Request Forgery in HTTP Request processing (CVE-2019-18677, bsc#1156328)

• Disable urn parsing and parsing of unknown schemes (bsc#1156329, CVE-2019-12523, CVE-2019-18676)

Jeriko One discovered that Squid incorrectly handled memory when connected to an FTP server. A remote attacker could possibly use this issue to obtain sensitive information from Squid memory. (CVE-2019-12528)

Regis Leroy discovered that Squid incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to access server resources prohibited by earlier security filters. (CVE-2020-8449)

Guido Vranken discovered that Squid incorrectly handled certain buffer operations when acting as a reverse proxy. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-8450)

Aaron Costello discovered that Squid incorrectly handled certain NTLM authentication credentials. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2020-8517)