OESA-2021-1020

Dashboard / Vulnerabilities / OESA-2021-1020

OESA-2021-1020

Summary: squid security update

Details: Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.\r\n\r\n Security Fix(es):\r\n\r\n An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while its being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack wont overflow.(CVE-2019-12519)\r\n\r\n

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1020, https://nvd.nist.gov/vuln/detail/CVE-2019-12519