Important: squid:4 security update
Summary
ALSA-2020:2041: Important: squid:4 security update. Affects libecap versions < 1.0.1-2.module_el8.6.0+2741+01592ae8. Fixed in 1.0.1-2.module_el8.6.0+2741+01592ae8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It is widely used to improve web server performance by caching frequently accessed content. This vulnerability affects version 4 of Squid.
Vulnerability Detail
The vulnerability in Squid version 4 is caused by multiple security issues:
-
CVE-2019-12519: An improper check for a new member in ESIExpression::Evaluate allows for a stack buffer overflow.
-
CVE-2020-11945: Improper access restriction upon Digest Authentication nonce replay could lead to remote code execution.
-
CVE-2019-12525: Parsing of the header Proxy-Authentication leads to memory corruption.
These vulnerabilities can be exploited by attackers to execute arbitrary code, cause denial of service, or gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.0.1-2.module_el8.6.0+2741+01592ae8
This is the first release that contains the fix.
sudo dnf update libecapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Squid version 4 is affected by multiple security vulnerabilities that can lead to remote code execution, denial of service, or unauthorized access. It is crucial to update to the latest version to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libecap →
FAQ
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
These vulnerabilities can be exploited by attackers to execute arbitrary code, cause denial of service, or gain unauthorized access to sensitive information.
To fix these vulnerabilities, it is recommended to update Squid to the latest version. The vendor has released a security update that addresses these issues. Users should upgrade to the fixed version as soon as possible.
No, there are no known workarounds for these vulnerabilities. It is recommended to update to the fixed version.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libecap.
