UbuntuUpdates.org

Package "squid-cgi"

Name: squid-cgi

Description:

Full featured Web Proxy cache (HTTP proxy) - control CGI

Latest version: 4.10-1ubuntu1.9
Release: focal (20.04)
Level: security
Repository: universe
Head package: squid
Homepage: http://www.squid-cache.org

Links


Download "squid-cgi"


Other versions of "squid-cgi" in Focal

Repository Area Version
base universe 4.10-1ubuntu1
updates universe 4.10-1ubuntu1.9

Changelog

Version: 4.10-1ubuntu1.9 2024-01-23 04:06:51 UTC

  squid (4.10-1ubuntu1.9) focal-security; urgency=medium

  * SECURITY UPDATE: denial of service in HTTP message processing
    - debian/patches/CVE-2023-49285.patch: additional parsing checks added to
      fix buffer overread in lib/rfc1123.c.
    - CVE-2023-49285
  * SECURITY UPDATE: denial of service in helper process management
    - debian/patches/CVE-2023-49286.patch: improved error handling included
      for helper process initialisation in src/ipc.cc.
    - CVE-2023-49286
  * SECURITY UPDATE: denial of service in HTTP request parsing
    - debian/patches/CVE-2023-50269.patch: limit x-forwarded-for hops and log
      limit as error when exceeded in src/ClientRequestContext.h,
      src/client_side_request.cc.
    - CVE-2023-50269

 -- Evan Caville <email address hidden> Tue, 16 Jan 2024 11:11:20 +1000

Source diff to previous version
CVE-2023-49285 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service a
CVE-2023-49286 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerabl
CVE-2023-50269 Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and version

Version: 4.10-1ubuntu1.8 2023-11-21 16:09:08 UTC

  squid (4.10-1ubuntu1.8) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via Gopher gateway
    - debian/patches/CVE-2023-46728.patch: disable gopher support in
      src/FwdState.cc, src/HttpRequest.cc, src/IoStats.h, src/Makefile.am,
      src/adaptation/ecap/Host.cc, src/adaptation/ecap/MessageRep.cc,
      src/anyp/ProtocolType.h, src/anyp/Uri.cc, src/anyp/UriScheme.cc,
      src/client_side_request.cc, src/err_type.h, src/HttpMsg.h,
      src/mgr/IoAction.cc, src/mgr/IoAction.h, src/stat.cc,
      src/Makefile.in.
    - CVE-2023-46728
  * SECURITY UPDATE: HTTP request smuggling, caused by chunked decoder
    lenience
    - debian/patches/CVE-2023-46846-pre1.patch: fix incremental parsing of
      chunked quoted extensions in src/adaptation/icap/ModXact.cc,
      src/adaptation/icap/ModXact.h, src/http/one/Parser.cc,
      src/http/one/Parser.h, src/http/one/RequestParser.cc,
      src/http/one/RequestParser.h, src/http/one/ResponseParser.cc,
      src/http/one/ResponseParser.h, src/http/one/TeChunkedParser.cc,
      src/http/one/TeChunkedParser.h, src/http/one/Tokenizer.cc,
      src/http/one/Tokenizer.h, src/http/one/forward.h,
      src/parser/BinaryTokenizer.h, src/parser/Makefile.am,
      src/parser/Tokenizer.cc, src/parser/Tokenizer.h,
      src/parser/forward.h.
    - debian/patches/CVE-2023-46846.patch: improve HTTP chunked encoding
      compliance in src/http/one/Parser.cc, src/http/one/Parser.h,
      src/http/one/TeChunkedParser.cc, src/parser/Tokenizer.cc,
      src/parser/Tokenizer.h.
    - CVE-2023-46846
  * SECURITY UPDATE: DoS via HTTP Digest Authentication
    - debian/patches/CVE-2023-46847.patch: fix stack buffer overflow when
      parsing Digest Authorization in src/auth/digest/Config.cc.
    - CVE-2023-46847

 -- Marc Deslauriers <email address hidden> Mon, 13 Nov 2023 10:13:50 -0500

Source diff to previous version
CVE-2023-46728 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of
CVE-2023-46846 SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling pas
CVE-2023-46847 Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to he

Version: 4.10-1ubuntu1.7 2022-09-26 17:06:21 UTC

  squid (4.10-1ubuntu1.7) focal-security; urgency=medium

  * SECURITY UPDATE: Exposure of Sensitive Information in Cache Manager
    - debian/patches/CVE-2022-41317.patch: fix typo in ACL in
      src/cf.data.pre.
    - CVE-2022-41317
  * SECURITY UPDATE: Buffer Over Read in SSPI and SMB Authentication
    - debian/patches/CVE-2022-41318.patch: improve checks in
      lib/ntlmauth/ntlmauth.cc.
    - CVE-2022-41318

 -- Marc Deslauriers <email address hidden> Fri, 23 Sep 2022 08:07:31 -0400

Source diff to previous version
CVE-2022-41317 Exposure of Sensitive Information in Cache Manager
CVE-2022-41318 Buffer Over Read in SSPI and SMB Authentication

Version: 4.10-1ubuntu1.6 2022-06-22 16:06:23 UTC

  squid (4.10-1ubuntu1.6) focal-security; urgency=medium

  * SECURITY UPDATE: Denial of Service in Gopher Processing
    - debian/patches/CVE-2021-46784.patch: improve handling of Gopher
      responses in src/gopher.cc.
    - CVE-2021-46784

 -- Marc Deslauriers <email address hidden> Tue, 21 Jun 2022 13:44:13 -0400

Source diff to previous version

Version: 4.10-1ubuntu1.5 2021-10-05 16:06:38 UTC

  squid (4.10-1ubuntu1.5) focal-security; urgency=medium

  * SECURITY UPDATE: information disclosure via OOB read in WCCP protocol
    - debian/patches/CVE-2021-28116.patch: validate packets better in
      src/wccp2.cc.
    - CVE-2021-28116

 -- Marc Deslauriers <email address hidden> Mon, 04 Oct 2021 08:31:27 -0400

CVE-2021-28116 Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol dat



About   -   Send Feedback to @ubuntu_updates