UbuntuUpdates.org

Package "squid"

Name: squid

Description:

Full featured Web Proxy cache (HTTP proxy)

Latest version: 3.5.27-1ubuntu1.11
Release: bionic (18.04)
Level: updates
Repository: main
Head package: squid3
Homepage: http://www.squid-cache.org

Links


Download "squid"


Other versions of "squid" in Bionic

Repository Area Version
base main 3.5.27-1ubuntu1
security main 3.5.27-1ubuntu1.11

Changelog

Version: 3.5.27-1ubuntu1.11 2021-06-03 18:06:20 UTC

  squid3 (3.5.27-1ubuntu1.11) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS via buffer-management bug
    - debian/patches/CVE-2021-28651.patch: fix memory leak in src/urn.cc.
    - CVE-2021-28651
  * SECURITY UPDATE: DoS via HTTP Range request
    - debian/patches/CVE-2021-3180x.patch: handle more Range requests in
      src/HttpHdrRange.cc, src/HttpHeaderRange.h, src/client_side.cc,
      src/client_side_request.cc, src/client_side_request.h.
    - CVE-2021-31806
    - CVE-2021-31807
    - CVE-2021-31808
  * SECURITY UPDATE: DoS via HTTP response
    - debian/patches/CVE-2021-33620.patch: handle more partial responses in
      src/HttpHdrContRange.cc, src/HttpHeaderRange.h,
      src/clients/Client.cc, src/client_side.cc.
    - CVE-2021-33620

 -- Marc Deslauriers <email address hidden> Wed, 02 Jun 2021 13:03:13 -0400

Source diff to previous version
CVE-2021-28651 An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a re
CVE-2021-3180 RESERVED
CVE-2021-31806 An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (ag
CVE-2021-31808 An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (ag
CVE-2021-33620 Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP respons

Version: 3.5.27-1ubuntu1.10 2021-03-29 16:06:34 UTC

  squid3 (3.5.27-1ubuntu1.10) bionic-security; urgency=medium

  * SECURITY UPDATE: HTTP Request Smuggling issue
    - debian/patches/CVE-2020-25097.patch: Add slash prefix to path-
      rootless or path-noscheme URLs in src/url.cc.
    - CVE-2020-25097

 -- Marc Deslauriers <email address hidden> Thu, 25 Mar 2021 12:45:30 -0400

Source diff to previous version
CVE-2020-25097 An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Req

Version: 3.5.27-1ubuntu1.9 2020-09-28 19:06:21 UTC

  squid3 (3.5.27-1ubuntu1.9) bionic-security; urgency=medium

  * SECURITY UPDATE: Request Smuggling and Poisoning issue
    - debian/patches/CVE-2020-15049.patch: validate Content-Length value
      prefix in src/http/ContentLengthInterpreter.cc,
      src/http/ContentLengthInterpreter.h.
    - CVE-2020-15049
  * SECURITY UPDATE: HTTP Request Smuggling issue
    - debian/patches/CVE-2020-15810.patch: enforce token characters for
      field-name in src/HttpHeader.cc.
    - CVE-2020-15810
  * SECURITY UPDATE: HTTP Request Splitting issue
    - debian/patches/CVE-2020-15811-pre.patch: validate Content-Length
      header values in src/HttpHeader.cc, src/HttpHeaderTools.cc,
      src/HttpHeaderTools.h, src/http/ContentLengthInterpreter.cc,
      src/http/ContentLengthInterpreter.h, src/http/Makefile.am.
    - debian/patches/CVE-2020-15811.patch: Improve Transfer-Encoding
      handling in src/HttpHeader.cc, src/HttpHeader.h, src/client_side.cc,
      src/http.cc.
    - CVE-2020-15811
  * SECURITY UPDATE: DoS via peer crafted Cache Digest response message
    - debian/patches/CVE-2020-24606.patch: fix livelocking in
      peerDigestHandleReply in src/peer_digest.cc.
    - CVE-2020-24606
  * Enable the test suite
    - debian/rules: enable test suite
    - debian/patches/enable-the-test-suite.patch: fix FTBFS.
    - debain/patches/fix-cppunit-detection.patch: don't use cppunit-config
      which is no longer available in bionic.

 -- Marc Deslauriers <email address hidden> Wed, 02 Sep 2020 11:35:51 -0400

Source diff to previous version
CVE-2020-15049 An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can s
CVE-2020-15810 An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed again
CVE-2020-15811 An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed again
CVE-2020-24606 Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a

Version: 3.5.27-1ubuntu1.8 2020-08-27 13:07:01 UTC

  squid3 (3.5.27-1ubuntu1.8) bionic-security; urgency=medium

  * SECURITY REGRESSION: regression when parsing icap and ecap protocols
    (LP: #1890265)
    - debian/patches/CVE-2019-12523-bug965012.patch
  * Thanks to Markus Koschany for the regression fix!

 -- Marc Deslauriers <email address hidden> Tue, 25 Aug 2020 13:12:13 -0400

Source diff to previous version
1890265 BUG: Version 3.5.27-1ubuntu1.7 breaks config using icap
CVE-2019-12523 An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through

Version: 3.5.27-1ubuntu1.7 2020-08-03 15:07:08 UTC

  squid3 (3.5.27-1ubuntu1.7) bionic-security; urgency=medium

  * SECURITY UPDATE: Multiple Issues in HTTP Request processing
    - debian/patches/CVE-2019-12520.patch: properly handle userinfo in
      src/url.cc.
    - CVE-2019-12520
    - CVE-2019-12524
  * SECURITY UPDATE: Multiple issues in URI processing
    - debian/patches/CVE-2019-12526.patch: replace patch with the one from
      Debian to get backported functions.
    - debian/patches/CVE-2019-12523.patch: update URI parser to use SBuf
      parsing APIs.
    - CVE-2019-12523
    - CVE-2019-18676
  * Thanks to Markus Koschany for the backports this update is based on.

 -- Marc Deslauriers <email address hidden> Tue, 28 Jul 2020 12:38:51 -0400

CVE-2019-12520 An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does th
CVE-2019-12524 An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid
CVE-2019-12526 An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a rem
CVE-2019-12523 An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through
CVE-2019-18676 An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in



About   -   Send Feedback to @ubuntu_updates