{"id":"CVE-2019-12522","aliases":["DEBIAN-CVE-2019-12522","EUVD-2019-4117","GHSA-rwjf-j42w-jfr4","UBUNTU-CVE-2019-12522"],"status":"published","title":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child...","description":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00344,"percentile":0.28154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2020-04-15T19:00:01Z","modified":"2026-11-04T20:01:35Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7-2","5.7-2+deb12u1","5.7-2+deb12u2","5.7-2+deb12u3","5.7-2+deb12u4","5.7-2+deb12u5","5.7-2+deb12u6","6.1-1","6.1-2","6.10-1","6.12-1","6.13-1","6.13-2","6.3-1","6.5-1","6.6-1","6.8-1","6.9-1","7.1-1","7.2-1","7.2-2","7.4-1","7.5-1","7.6-1","7.6-2","7.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13-2","6.13-2+deb13u1","6.13-2+deb13u2","6.13-2+deb13u3","7.1-1","7.2-1","7.2-2","7.4-1","7.5-1","7.6-1","7.6-2","7.7-1"]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13-2","7.1-1","7.2-1","7.2-2","7.4-1","7.5-1","7.6-1","7.6-2","7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4","3.5.12-1ubuntu7.5","3.5.12-1ubuntu7.6","3.5.12-1ubuntu7.7","3.5.12-1ubuntu7.8","3.5.12-1ubuntu7.9","3.5.12-1ubuntu7.10","3.5.12-1ubuntu7.11","3.5.12-1ubuntu7.12","3.5.12-1ubuntu7.13","3.5.12-1ubuntu7.14","3.5.12-1ubuntu7.15","3.5.12-1ubuntu7.16","3.5.12-1ubuntu7.16+esm1","3.5.12-1ubuntu7.16+esm2","3.5.12-1ubuntu7.16+esm3","3.5.12-1ubuntu7.16+esm4","3.5.12-1ubuntu7.16+esm5","3.5.12-1ubuntu7.16+esm6","3.5.12-1ubuntu7.16+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9","3.5.27-1ubuntu1.10","3.5.27-1ubuntu1.11","3.5.27-1ubuntu1.12","3.5.27-1ubuntu1.13","3.5.27-1ubuntu1.14","3.5.27-1ubuntu1.14+esm1","3.5.27-1ubuntu1.14+esm2","3.5.27-1ubuntu1.14+esm3","3.5.27-1ubuntu1.14+esm4","3.5.27-1ubuntu1.14+esm5","3.5.27-1ubuntu1.14+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3","4.10-1ubuntu1.4","4.10-1ubuntu1.5","4.10-1ubuntu1.6","4.10-1ubuntu1.7","4.10-1ubuntu1.8","4.10-1ubuntu1.9","4.10-1ubuntu1.10","4.10-1ubuntu1.11","4.10-1ubuntu1.12","4.10-1ubuntu1.13","4.10-1ubuntu1.13+esm1","4.10-1ubuntu1.13+esm2","4.10-1ubuntu1.13+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13-10ubuntu5","5.2-1ubuntu1","5.2-1ubuntu3","5.2-1ubuntu4","5.2-1ubuntu4.1","5.2-1ubuntu4.2","5.2-1ubuntu4.3","5.7-0ubuntu0.22.04.1","5.7-0ubuntu0.22.04.2","5.7-0ubuntu0.22.04.3","5.7-0ubuntu0.22.04.4","5.9-0ubuntu0.22.04.1","5.9-0ubuntu0.22.04.2","5.9-0ubuntu0.22.04.3","5.9-0ubuntu0.22.04.4","5.9-0ubuntu0.22.04.5","5.9-0ubuntu0.22.04.7","5.9-0ubuntu0.22.04.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1-2ubuntu1","6.1-2ubuntu2","6.5-1ubuntu1","6.5-1ubuntu2","6.5-1ubuntu3","6.6-1ubuntu4","6.6-1ubuntu5","6.6-1ubuntu5.1","6.10-0ubuntu0.24.04.1","6.13-0ubuntu0.24.04.1","6.13-0ubuntu0.24.04.2","6.13-0ubuntu0.24.04.3","6.14-0ubuntu0.24.04.1","6.14-0ubuntu0.24.04.2","6.14-0ubuntu0.24.04.4","6.14-0ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13-1ubuntu1","6.13-1ubuntu2","6.13-1ubuntu3","6.13-1ubuntu4","6.13-1ubuntu4.1","6.14-0ubuntu0.25.10.1","6.14-0ubuntu0.25.10.2","6.14-0ubuntu0.25.10.4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2-2ubuntu2","7.6-2ubuntu1","7.6-2ubuntu3","7.7-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13-1ubuntu4","6.13-1ubuntu5","7.2-2ubuntu1","7.2-2ubuntu2","7.2-2ubuntu2.2","7.7-0ubuntu0.26.04.1","7.7-0ubuntu0.26.04.2"]}],"products":[{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12522.txt","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20210205-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12522"},{"url":"https://github.com/advisories/GHSA-rwjf-j42w-jfr4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12522","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-12522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12522","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-12522","description":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","status":"published","published":"2020-04-15T19:00:01Z","modified":"2024-08-04T23:24:38.888Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-4117","description":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","status":"published","published":"2020-04-15T19:00:01Z","modified":"2024-08-04T23:24:38Z","updated_at":"2026-11-03T02:40:45.434408Z"}],"ghsa":[{"id":"GHSA-rwjf-j42w-jfr4","title":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child...","description":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","status":"published","published":"2022-05-24T17:14:19Z","modified":"2023-01-29T05:02:14Z","cwes":["CWE-269"],"updated_at":"2026-11-02T14:45:02.058324Z"}],"nvd":[{"id":"CVE-2019-12522","description":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","status":"published","published":"2020-04-15T19:15:12.473Z","modified":"2026-06-17T02:14:49.01Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-12522","description":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","status":"published","published":"2020-04-15T19:15:12.473Z","modified":"2026-10-24T10:30:28.360492122Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12522","description":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","status":"published","published":"2020-04-15T19:15:12.473Z","modified":"2026-09-21T07:01:48.794601264Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-12522","description":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","status":"published","published":"2020-04-15T19:15:00Z","modified":"2026-11-04T20:01:35.184070615Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T14:21:53.124154Z"}]}}