Red Hat Security Advisory

RHSA-2020:4743

squid:4 security, bug fix, and enhancement update

Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.aarch64::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.s390x::squid:4 +11

Fixes 18 records

TI-2020-06787 CVE-2020-8450 · GHSA-vrcq-r42v-wc44

An issue was discovered in Squid before 4.10.

HIGH 70

An issue was discovered in Squid before 4.10.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.7179 Published 2020-02-04 Partial fix CWE-131

TI-2019-13517 CVE-2019-18679 · GHSA-4h4q-q4v8-2vq3

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8.

MEDIUM 61

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.40982 Published 2019-11-26 Partial fix CWE-200

TI-2019-09357 CVE-2019-12526 · GHSA-rqc4-5489-hg7v

An issue was discovered in Squid before 4.9.

MEDIUM 61

An issue was discovered in Squid before 4.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20251 Published 2019-11-26 Partial fix CWE-787

TI-2020-11830 CVE-2020-15049

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x…

MEDIUM 51

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.05706 Published 2020-06-30 Partial fix CWE-444

TI-2019-09355 CVE-2019-12524 · GHSA-wwv6-9vqw-fwxx

An issue was discovered in Squid through 4.7.

MEDIUM 49

An issue was discovered in Squid through 4.7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03862 Published 2020-04-15 Partial fix CWE-306

TI-2019-09630 CVE-2019-12854 · GHSA-pxgg-fcwc-pc9f

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access…

MEDIUM 46

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.11708 Published 2019-08-15 Fixed

TI-2019-09359 CVE-2019-12528 · GHSA-pjg3-3q79-q39r

An issue was discovered in Squid before 4.10.

MEDIUM 46

An issue was discovered in Squid before 4.10.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10493 Published 2020-02-04 Partial fix

TI-2019-09354 CVE-2019-12523 · GHSA-99vq-f459-jqrg

An issue was discovered in Squid before 4.9.

MEDIUM 46

An issue was discovered in Squid before 4.9.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04302 Published 2019-11-26 Partial fix

TI-2020-15082 CVE-2020-24606

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service…

MEDIUM 45

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.04961 Published 2020-08-24 Partial fix CWE-667

TI-2019-13514 CVE-2019-18676 · GHSA-chw7-jm99-chw8

An issue was discovered in Squid 3.x and 4.x through 4.8.

MEDIUM 45

An issue was discovered in Squid 3.x and 4.x through 4.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0918 Published 2019-11-26 Partial fix CWE-787

TI-2020-06786 CVE-2020-8449 · GHSA-rmc2-g977-jr5r

An issue was discovered in Squid before 4.10.

MEDIUM 44

An issue was discovered in Squid before 4.10.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08311 Published 2020-02-04 Partial fix CWE-668

TI-2019-09351 CVE-2019-12520 · GHSA-gx26-q49r-m7g8

An issue was discovered in Squid through 4.7 and 5.

MEDIUM 40

An issue was discovered in Squid through 4.7 and 5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03924 Published 2020-04-15 Partial fix CWE-20

TI-2020-11010 CVE-2020-14058

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3.

LOW 38

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02538 Published 2020-06-30 Partial fix

TI-2019-09360 CVE-2019-12529 · GHSA-99gm-2796-7c8p

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x…

LOW 37

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.08092 Published 2019-07-11 Partial fix CWE-125

TI-2019-13594 CVE-2019-18860 · GHSA-f3c4-4h69-w2fp

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka…

LOW 35

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04995 Published 2020-03-20 Partial fix CWE-74

TI-2019-09352 CVE-2019-12521 · GHSA-7mv4-9v7r-5gq3

An issue was discovered in Squid through 4.7.

LOW 35

An issue was discovered in Squid through 4.7.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.05909 Published 2020-04-15 Partial fix CWE-193

TI-2019-13515 CVE-2019-18677 · GHSA-mm65-p7g9-c5hr

An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting…

LOW 34

An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03933 Published 2019-11-26 Partial fix CWE-352

TI-2019-13516 CVE-2019-18678 · GHSA-jvgf-c7c2-w98p

An issue was discovered in Squid 3.x and 4.x through 4.8.

LOW 33

An issue was discovered in Squid 3.x and 4.x through 4.8.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.062 Published 2019-11-26 Partial fix CWE-444