USN-4551-1

Dashboard / Vulnerabilities / USN-4551-1

USN-4551-1

Summary: squid3 vulnerabilities

Details: Alex Rousskov and Amit Klein discovered that Squid incorrectly handled certain Content-Length headers. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. (CVE-2020-15049) Amit Klein discovered that Squid incorrectly validated certain data. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. (CVE-2020-15810) Régis Leroy discovered that Squid incorrectly validated certain data. A remote attacker could possibly use this issue to perform an HTTP request splitting attack, resulting in cache poisoning. (CVE-2020-15811) Lubos Uhliarik discovered that Squid incorrectly handled certain Cache Digest response messages sent by trusted peers. A remote attacker could possibly use this issue to cause Squid to consume resources, resulting in a denial of service. (CVE-2020-24606)

References: https://ubuntu.com/security/notices/USN-4551-1, https://ubuntu.com/security/CVE-2020-15049, https://ubuntu.com/security/CVE-2020-15810, https://ubuntu.com/security/CVE-2020-15811, https://ubuntu.com/security/CVE-2020-24606