USN-4446-2
squid3 regression
USN-4446-1 fixed vulnerabilities in Squid. The update introduced a regression when using Squid with the icap or ecap protocols. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jeriko One discovered that Squid incorrectly handled caching certain requests. A remote attacker could possibly use this issue to perform cache-injection attacks or gain access to reverse proxy features such as ESI. (CVE-2019-12520)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain URN requests. A remote attacker could possibly use this issue to bypass access checks. (CVE-2019-12523)
Jeriko One discovered that Squid incorrectly handled URL decoding. A remote attacker could possibly use this issue to bypass certain rule checks. (CVE-2019-12524)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled input validation. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2019-18676)
What each source reports
OSV No score
squid3 regression
USN-4446-1 fixed vulnerabilities in Squid. The update introduced a regression when using Squid with the icap or ecap protocols. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jeriko One discovered that Squid incorrectly handled caching certain requests. A remote attacker could possibly use this issue to perform cache-injection attacks or gain access to reverse proxy features such as ESI. (CVE-2019-12520)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain URN requests. A remote attacker could possibly use this issue to bypass access checks. (CVE-2019-12523)
Jeriko One discovered that Squid incorrectly handled URL decoding. A remote attacker could possibly use this issue to bypass certain rule checks. (CVE-2019-12524)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled input validation. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2019-18676)
- Record
USN-4446-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squid3Ubuntu:16.04:LTS |
before 3.5.12-1ubuntu7.13, plus listed versions 3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.1 Show 11 moreShow less3.5.12-1ubuntu7.23.5.12-1ubuntu7.33.5.12-1ubuntu7.43.5.12-1ubuntu7.53.5.12-1ubuntu7.63.5.12-1ubuntu7.73.5.12-1ubuntu7.83.5.12-1ubuntu7.93.5.12-1ubuntu7.103.5.12-1ubuntu7.113.5.12-1ubuntu7.12 |
3.5.12-1ubuntu7.13 |
squid3Ubuntu:18.04:LTS |
before 3.5.27-1ubuntu1.8, plus listed versions 3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.13.5.27-1ubuntu1.2 Show 5 moreShow less3.5.27-1ubuntu1.33.5.27-1ubuntu1.43.5.27-1ubuntu1.53.5.27-1ubuntu1.63.5.27-1ubuntu1.7 |
3.5.27-1ubuntu1.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-4446-2 is a vulnerability with no CVSS score yet in squid3, published August 27, 2020. No source lists public exploit code. Fixed in squid3 3.5.12-1ubuntu7.13.