[SECURITY] [DLA 2028-1] squid3 security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Package : squid3
Version : 3.4.8-6+deb8u9
CVE ID : CVE-2019-12526 CVE-2019-18677 CVE-2019-18678
CVE-2019-18679
It was found that Squid, a high-performance proxy caching server for
web clients, has been affected by the following security
vulnerabilities.
CVE-2019-12526
URN response handling in Squid suffers from a heap-based buffer
overflow. When receiving data from a remote server in response to
an URN request, Squid fails to ensure that the response can fit
within the buffer. This leads to attacker controlled data
overflowing in the heap.
CVE-2019-18677
When the append_domain setting is used (because the appended
characters do not properly interact with hostname length
restrictions), it can inappropriately redirect traffic to origins
it should not be delivered to. This happens because of incorrect
message processing.
CVE-2019-18678
A programming error allows attackers to smuggle HTTP requests
through frontend software to a Squid instance that splits the HTTP
Request pipeline differently. The resulting Response messages
corrupt caches (between a client and Squid) with
attacker-controlled content at arbitrary URLs. Effects are isolated
to software between the attacker client and Squid.
There are no effects on Squid itself, nor on any upstream servers.
The issue is related to a request header containing whitespace
between a header name and a colon.
CVE-2019-18679
Due to incorrect data management, Squid is vulnerable to
information disclosure when processing HTTP Digest Authentication.
Nonce tokens contain the raw byte value of a pointer that sits
within heap memory allocation. This information reduces ASLR
protections and may aid attackers isolating memory areas to target
for remote code execution attacks.
For Debian 8 "Jessie", these problems have been fixed in version
3.4.8-6+deb8u9.
We recommend that you upgrade your squid3 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAl3vtApfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeRcphAAs1ESPsZm0g3jfchmXokHdlimFl7/mPe+fZQLn7oQyh/FpciaRnRcKBLj
W6JvqRRIhMisauaCEPuMq3vNdjaD0POSJ5yJQloHunZDz462QjtPMMB3P8boBCua
lrD3tamQ+neewFEpnf+ruicHx2Aoy/f7/TjbFthJ3HyMAFtik/hXKolNZGX1VPPe
agznvVYp++sxuK93z23zazSAJoqysdpc6ffrnPeLJyPCE7ZmaYPjzUODqadixRJh
xRYg3ryIob6W7dFde3FKRGsKIw5ufcbKwdWd7CTKoApP9PhVQQR24s5K8UKB9xPz
n/msdiYJRr5r1oXHWgphPzBGrHlIHmjez7arVtBf9bt8H8m9H3/Xs+TRzI3RLb9E
t6DIBW/y9jt0jSFz7bDIQRW9cudoKuKeFEQff0RRm8Rt140m2rauq8cHPrBiz8QJ
uE8IwSugqjke7B/afg8TK4yzSfEP0/zvBq1hjtZjxy32ssPkYQPoNLFPYCnpZwAU
xRAHYZyUkL4Z5aqRkXRRKGmYZML7rJzijyAuNs6VwmVwcNdIOcbFXt/pGqvl63/a
9guPf+qLZvxe/4yFg/12d2jYB2otanI5LDGTneG9+CdDKpxNDOU7oXnAMyERh6Io
05tu3qcWOO9vgjN6QY/5zELZE17ABQ5oYs2nGuzEvZM8kddGtUk=
=opGW
-----END PGP SIGNATURE-----
Reply to: