[USN-4895-1] Squid vulnerabilities
Severity
Medium
Affected Packages
22
CVEs
2
Several security issues were fixed in Squid.
Alex Rousskov and Amit Klein discovered that Squid incorrectly handled
certain Content-Length headers. A remote attacker could possibly use this
issue to perform an HTTP request smuggling attack, resulting in cache
poisoning. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-15049)
Jianjun Chen discovered that Squid incorrectly validated certain input. A
remote attacker could use this issue to perform HTTP Request Smuggling and
possibly access services forbidden by the security controls.
(CVE-2020-25097)
- ID
- USN-4895-1
- Severity
- medium
- URL
- https://ubuntu.com/security/notices/USN-4895-1
- Published
-
2021-03-29T13:05:00
(3 years ago) - Modified
-
2021-03-29T13:05:00
(3 years ago) - Other Advisories
-
- ALAS-2020-1453
- ALAS2-2021-1631
- ALPINE:CVE-2020-15049
- ALPINE:CVE-2020-25097
- ALSA-2020:4743
- ALSA-2021:1979
- DSA-4732-1
- DSA-4873-1
- ELSA-2020-4082
- ELSA-2021-1135
- ELSA-2021-1979
- FEDORA-2020-cbebc5617e
- FEDORA-2021-76f09062a7
- FEDORA-2021-7d86bec29e
- FEDORA-2021-ecb24e0b9d
- GLSA-202105-14
- openSUSE-SU-2020:1346-1
- openSUSE-SU-2020:1369-1
- openSUSE-SU-2021:0879-1
- openSUSE-SU-2021:1961-1
- RHSA-2020:4082
- RHSA-2020:4743
- RHSA-2021:1135
- RHSA-2021:1979
- RLSA-2020:4743
- RLSA-2021:1979
- SUSE-SU-2020:1946-1
- SUSE-SU-2020:2442-1
- SUSE-SU-2020:2443-1
- SUSE-SU-2021:1838-1
- SUSE-SU-2021:1961-1
- SUSE-SU-2022:2392-1
- USN-4551-1
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:deb/ubuntu/squidclient?distro=xenial | ubuntu | squidclient | < 3.5.12-1ubuntu7.16 | xenial | ||
Affected | pkg:deb/ubuntu/squidclient?distro=groovy | ubuntu | squidclient | < 4.13-1ubuntu2.1 | groovy | ||
Affected | pkg:deb/ubuntu/squidclient?distro=focal | ubuntu | squidclient | < 4.10-1ubuntu1.3 | focal | ||
Affected | pkg:deb/ubuntu/squidclient?distro=bionic | ubuntu | squidclient | < 3.5.27-1ubuntu1.10 | bionic | ||
Affected | pkg:deb/ubuntu/squid?distro=xenial | ubuntu | squid | < 3.5.12-1ubuntu7.16 | xenial | ||
Affected | pkg:deb/ubuntu/squid?distro=groovy | ubuntu | squid | < 4.13-1ubuntu2.1 | groovy | ||
Affected | pkg:deb/ubuntu/squid?distro=focal | ubuntu | squid | < 4.10-1ubuntu1.3 | focal | ||
Affected | pkg:deb/ubuntu/squid?distro=bionic | ubuntu | squid | < 3.5.27-1ubuntu1.10 | bionic | ||
Affected | pkg:deb/ubuntu/squid3?distro=xenial | ubuntu | squid3 | < 3.5.12-1ubuntu7.16 | xenial | ||
Affected | pkg:deb/ubuntu/squid3?distro=bionic | ubuntu | squid3 | < 3.5.27-1ubuntu1.10 | bionic | ||
Affected | pkg:deb/ubuntu/squid-purge?distro=xenial | ubuntu | squid-purge | < 3.5.12-1ubuntu7.16 | xenial | ||
Affected | pkg:deb/ubuntu/squid-purge?distro=groovy | ubuntu | squid-purge | < 4.13-1ubuntu2.1 | groovy | ||
Affected | pkg:deb/ubuntu/squid-purge?distro=focal | ubuntu | squid-purge | < 4.10-1ubuntu1.3 | focal | ||
Affected | pkg:deb/ubuntu/squid-purge?distro=bionic | ubuntu | squid-purge | < 3.5.27-1ubuntu1.10 | bionic | ||
Affected | pkg:deb/ubuntu/squid-common?distro=xenial | ubuntu | squid-common | < 3.5.12-1ubuntu7.16 | xenial | ||
Affected | pkg:deb/ubuntu/squid-common?distro=groovy | ubuntu | squid-common | < 4.13-1ubuntu2.1 | groovy | ||
Affected | pkg:deb/ubuntu/squid-common?distro=focal | ubuntu | squid-common | < 4.10-1ubuntu1.3 | focal | ||
Affected | pkg:deb/ubuntu/squid-common?distro=bionic | ubuntu | squid-common | < 3.5.27-1ubuntu1.10 | bionic | ||
Affected | pkg:deb/ubuntu/squid-cgi?distro=xenial | ubuntu | squid-cgi | < 3.5.12-1ubuntu7.16 | xenial | ||
Affected | pkg:deb/ubuntu/squid-cgi?distro=groovy | ubuntu | squid-cgi | < 4.13-1ubuntu2.1 | groovy | ||
Affected | pkg:deb/ubuntu/squid-cgi?distro=focal | ubuntu | squid-cgi | < 4.10-1ubuntu1.3 | focal | ||
Affected | pkg:deb/ubuntu/squid-cgi?distro=bionic | ubuntu | squid-cgi | < 3.5.27-1ubuntu1.10 | bionic |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |