[GLSA-202003-34] Squid: Multiple vulnerabilities

Severity Normal

Affected Packages 1

Unaffected Packages 1

CVEs 7

Multiple vulnerabilities have been found in Squid, the worst of which could lead to arbitrary code execution.

Background
Squid is a full-featured Web proxy cache designed to run on Unix
systems. It supports proxying and caching of HTTP, FTP, and other URLs,
as well as SSL support, cache hierarchies, transparent caching, access
control lists and many other features.

Description
Multiple vulnerabilities have been discovered in Squid. Please review
the CVE identifiers referenced below for details.

Impact
A remote attacker, by sending a specially crafted request, could
possibly execute arbitrary code with the privileges of the process,
obtain sensitive information or cause a Denial of Service condition.

Workaround
There is no known workaround at this time.

Resolution
All Squid users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-proxy/squid-4.10"

Package	Affected Version
pkg:ebuild/net-proxy/squid?distro=gentoo	< 4.10

Package	Unaffected Version
pkg:ebuild/net-proxy/squid?distro=gentoo	>= 4.10

ID

GLSA-202003-34

Severity

normal

URL

https://security.gentoo.org/glsa/202003-34

Published

2020-03-16T00:00:00
(4 years ago)

Modified

2020-03-16T00:00:00
(4 years ago)

Rights

Gentoo Foundation, Inc.

Other Advisories

Source	# ID	Name	URL
CVE	CVE-2019-12526	CVE-2019-12526	https://nvd.nist.gov/vuln/detail/CVE-2019-12526
CVE	CVE-2019-12528	CVE-2019-12528	https://nvd.nist.gov/vuln/detail/CVE-2019-12528
CVE	CVE-2019-18678	CVE-2019-18678	https://nvd.nist.gov/vuln/detail/CVE-2019-18678
CVE	CVE-2019-18679	CVE-2019-18679	https://nvd.nist.gov/vuln/detail/CVE-2019-18679
CVE	CVE-2020-8449	CVE-2020-8449	https://nvd.nist.gov/vuln/detail/CVE-2020-8449
CVE	CVE-2020-8450	CVE-2020-8450	https://nvd.nist.gov/vuln/detail/CVE-2020-8450
CVE	CVE-2020-8517	CVE-2020-8517	https://nvd.nist.gov/vuln/detail/CVE-2020-8517
Bugzilla	699854	Bugzilla #699854	https://bugs.gentoo.org/show_bug.cgi?id=699854
Bugzilla	708296	Bugzilla #708296	https://bugs.gentoo.org/show_bug.cgi?id=708296

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:ebuild/net-proxy/squid?distro=gentoo	net-proxy	squid	< 4.10	gentoo
Unaffected	pkg:ebuild/net-proxy/squid?distro=gentoo	net-proxy	squid	>= 4.10	gentoo

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date