Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

Ubuntu 18.04 LTS Squid: 4446-1 Moderate: Addressing Multiple Issues

ubuntu
Calendar Grey August 3, 2020
Dist Ubuntu Esm H88
Multiple vulnerabilities resolved in Squid for Ubuntu, targeting access control evasion and DDoS threats. Upgrade advised.
Several security issues were fixed in Squid.

Summary

Several security issues were fixed in Squid.

Software Description:

- squid3: Web proxy cache server

Details:

Jeriko One discovered that Squid incorrectly handled caching certain

requests. A remote attacker could possibly use this issue to perform

cache-injection attacks or gain access to reverse proxy features such as

ESI. (CVE-2019-12520)

Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly

handled certain URN requests. A remote attacker could possibly use this

issue to bypass access checks. (CVE-2019-12523)

Jeriko One discovered that Squid incorrectly handled URL decoding. A remote

attacker could possibly use this issue to bypass certain rule checks.

(CVE-2019-12524)

Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly

handled input validation. A remote attacker could use this issue to cause

Squid to crash, resulting in a denial of service. (CVE-2019-18676)

Topics%20covered

Topics Covered

security advisory denial service squid input validation ubuntu access bypass cache injection

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
  squid                           3.5.27-1ubuntu1.7

Ubuntu 16.04 LTS:
  squid                           3.5.12-1ubuntu7.12

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4446-1

CVE-2019-12520, CVE-2019-12523, CVE-2019-12524, CVE-2019-18676

Severity
important
Lowest
Low
Medium
High
Critical

August 03, 2020

Topics%20covered

Topics Covered

security advisory denial service squid input validation ubuntu access bypass cache injection

Package Information

https://launchpad.net/ubuntu/+source/squid3/3.5.27-1ubuntu1.7
https://launchpad.net/ubuntu/+source/squid3/3.5.12-1ubuntu7.12

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here