UBUNTU-CVE-2020-15810

    Dashboard / Vulnerabilities / UBUNTU-CVE-2020-15810

    UBUNTU-CVE-2020-15810

    Published: 24 Aug 2020Last Modified: 4 Feb 2026
    Upstream:
    CVE-2020-15810

    Summary:

    Details: An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.

    References: https://ubuntu.com/security/CVE-2020-15810, https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m, https://ubuntu.com/security/notices/USN-4477-1, https://ubuntu.com/security/notices/USN-4551-1, https://www.cve.org/CVERecord?id=CVE-2020-15810

    Affected packages

    Package

    Name: squid3

    Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.5.12-1ubuntu7.15

    Affected versions

    3.3.8-1ubuntu16
    3.3.8-1ubuntu17

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2020-15810 | CVE-DB