[USN-4446-2] Squid regression
USN-4446-1 introduced a regression in Squid.
USN-4446-1 fixed vulnerabilities in Squid. The update introduced a
regression when using Squid with the icap or ecap protocols. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jeriko One discovered that Squid incorrectly handled caching certain
requests. A remote attacker could possibly use this issue to perform
cache-injection attacks or gain access to reverse proxy features such as
ESI. (CVE-2019-12520)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled certain URN requests. A remote attacker could possibly use this
issue to bypass access checks. (CVE-2019-12523)
Jeriko One discovered that Squid incorrectly handled URL decoding. A remote
attacker could possibly use this issue to bypass certain rule checks.
(CVE-2019-12524)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled input validation. A remote attacker could use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2019-18676)
Package | Affected Version |
---|---|
pkg:deb/ubuntu/squidclient?distro=xenial | < 3.5.12-1ubuntu7.13 |
pkg:deb/ubuntu/squidclient?distro=bionic | < 3.5.27-1ubuntu1.8 |
pkg:deb/ubuntu/squid?distro=xenial | < 3.5.12-1ubuntu7.13 |
pkg:deb/ubuntu/squid?distro=bionic | < 3.5.27-1ubuntu1.8 |
pkg:deb/ubuntu/squid3?distro=xenial | < 3.5.12-1ubuntu7.13 |
pkg:deb/ubuntu/squid3?distro=bionic | < 3.5.27-1ubuntu1.8 |
pkg:deb/ubuntu/squid-purge?distro=xenial | < 3.5.12-1ubuntu7.13 |
pkg:deb/ubuntu/squid-purge?distro=bionic | < 3.5.27-1ubuntu1.8 |
pkg:deb/ubuntu/squid-common?distro=xenial | < 3.5.12-1ubuntu7.13 |
pkg:deb/ubuntu/squid-common?distro=bionic | < 3.5.27-1ubuntu1.8 |
pkg:deb/ubuntu/squid-cgi?distro=xenial | < 3.5.12-1ubuntu7.13 |
pkg:deb/ubuntu/squid-cgi?distro=bionic | < 3.5.27-1ubuntu1.8 |
- ID
- USN-4446-2
- Severity
- none
- URL
- https://ubuntu.com/security/notices/USN-4446-2
- Published
-
2020-08-27T10:46:21
(4 years ago) - Modified
-
2020-08-27T10:46:21
(4 years ago)
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:deb/ubuntu/squidclient?distro=xenial | ubuntu | squidclient | < 3.5.12-1ubuntu7.13 | xenial | ||
Affected | pkg:deb/ubuntu/squidclient?distro=bionic | ubuntu | squidclient | < 3.5.27-1ubuntu1.8 | bionic | ||
Affected | pkg:deb/ubuntu/squid?distro=xenial | ubuntu | squid | < 3.5.12-1ubuntu7.13 | xenial | ||
Affected | pkg:deb/ubuntu/squid?distro=bionic | ubuntu | squid | < 3.5.27-1ubuntu1.8 | bionic | ||
Affected | pkg:deb/ubuntu/squid3?distro=xenial | ubuntu | squid3 | < 3.5.12-1ubuntu7.13 | xenial | ||
Affected | pkg:deb/ubuntu/squid3?distro=bionic | ubuntu | squid3 | < 3.5.27-1ubuntu1.8 | bionic | ||
Affected | pkg:deb/ubuntu/squid-purge?distro=xenial | ubuntu | squid-purge | < 3.5.12-1ubuntu7.13 | xenial | ||
Affected | pkg:deb/ubuntu/squid-purge?distro=bionic | ubuntu | squid-purge | < 3.5.27-1ubuntu1.8 | bionic | ||
Affected | pkg:deb/ubuntu/squid-common?distro=xenial | ubuntu | squid-common | < 3.5.12-1ubuntu7.13 | xenial | ||
Affected | pkg:deb/ubuntu/squid-common?distro=bionic | ubuntu | squid-common | < 3.5.27-1ubuntu1.8 | bionic | ||
Affected | pkg:deb/ubuntu/squid-cgi?distro=xenial | ubuntu | squid-cgi | < 3.5.12-1ubuntu7.13 | xenial | ||
Affected | pkg:deb/ubuntu/squid-cgi?distro=bionic | ubuntu | squid-cgi | < 3.5.27-1ubuntu1.8 | bionic |