UbuntuUpdates.org

Package "squid"

Name: squid

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Full featured Web Proxy cache (HTTP proxy) - control CGI
  • Full featured Web Proxy cache (HTTP proxy) - cache management utility
  • Full featured Web Proxy cache (HTTP proxy) - HTTP(S) message utility
Latest version: 4.10-1ubuntu1.8
Release: focal (20.04)
Level: security
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "squid" in Focal

Repository Area Version
base main 4.10-1ubuntu1
security main 4.10-1ubuntu1.8
updates main 4.10-1ubuntu1.8
updates universe 4.10-1ubuntu1.8

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 4.10-1ubuntu1.3 2021-03-29 15:06:24 UTC

  squid (4.10-1ubuntu1.3) focal-security; urgency=medium

  * SECURITY UPDATE: Request Smuggling and Poisoning issue
    - debian/patches/CVE-2020-15049.patch: validate Content-Length value
      prefix in src/http/ContentLengthInterpreter.cc,
      src/http/ContentLengthInterpreter.h.
    - CVE-2020-15049
  * SECURITY UPDATE: HTTP Request Smuggling issue
    - debian/patches/CVE-2020-25097.patch: Add slash prefix to path-
      rootless or path-noscheme URLs in src/anyp/Uri.cc.
    - CVE-2020-25097

 -- Marc Deslauriers <email address hidden> Thu, 25 Mar 2021 12:41:48 -0400
Source diff to previous version
CVE-2020-15049 An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can s
CVE-2020-25097 An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Req

Version: 4.10-1ubuntu1.2 2020-08-27 18:07:08 UTC

  squid (4.10-1ubuntu1.2) focal-security; urgency=medium

  * SECURITY UPDATE: HTTP Request Smuggling issue
    - debian/patches/CVE-2020-15810.patch: enforce token characters for
      field-name in src/HttpHeader.cc.
    - CVE-2020-15810
  * SECURITY UPDATE: HTTP Request Splitting issue
    - debian/patches/CVE-2020-15811.patch: improve Transfer-Encoding
      handling in src/HttpHeader.cc, src/HttpHeader.h, src/client_side.cc,
      src/http.cc.
    - CVE-2020-15811
  * SECURITY UPDATE: DoS via peer crafted Cache Digest response message
    - debian/patches/CVE-2020-24606.patch: fix livelocking in
      peerDigestHandleReply in src/peer_digest.cc.
    - CVE-2020-24606

 -- Marc Deslauriers <email address hidden> Tue, 25 Aug 2020 12:56:26 -0400
Source diff to previous version
CVE-2020-24606 Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a

Version: 4.10-1ubuntu1.1 2020-05-13 12:06:54 UTC

  squid (4.10-1ubuntu1.1) focal-security; urgency=medium

  * SECURITY UPDATE: multiple ESI issues
    - debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
      into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
      src/esi/Esi.h, src/esi/Expression.cc.
    - CVE-2019-12519
    - CVE-2019-12521
  * SECURITY UPDATE: Digest Authentication nonce replay issue
    - debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
      overflow in src/auth/digest/Config.cc.
    - CVE-2020-11945

 -- Marc Deslauriers <email address hidden> Thu, 07 May 2020 09:21:58 -0400
CVE-2019-12519 An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function
CVE-2019-12521 An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for ho
CVE-2020-11945 An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that ar


About   -   Send Feedback to @ubuntu_updates