Critical Buffer Overflow Vulnerability in Squid Package - CVE-2019-12519
Summary
ALPINE-CVE-2019-12519: An issue was discovered in Squid through 4.7. Affects squid versions < 4.11-r0. Fixed in 4.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely-used caching proxy for the web that supports HTTP, HTTPS, FTP, and more. It is designed to improve web performance by caching frequently requested content and reducing bandwidth usage. However, Squid has been found to have a critical vulnerability that affects its ability to handle ESI (Edge Side Includes) tags, specifically the 'esi:when' tag, which can lead to severe security risks.
Vulnerability Detail
An issue was discovered in Squid through version 4.7, where the handling of the 'esi:when' tag with ESI enabled leads to a buffer overflow. The function ESIExpression::Evaluate uses a fixed stack buffer to evaluate expressions. When processing these expressions, there is a risk of stack overflow due to the lack of checks when adding new members to the stack. This vulnerability can allow attackers to execute arbitrary code, leading to potential system compromise.
How To Fix
Minimum fixed version
4.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable ESI processing in Squid's configuration to mitigate the risk of exploitation until the package is updated. This can be done by modifying the Squid configuration file (squid.conf) and setting 'esi off'.
Conclusion
The CVE-2019-12519 vulnerability in the Squid package poses a significant risk due to its potential for buffer overflow and arbitrary code execution. Users are strongly advised to update to the patched version 4.11-r0 to mitigate this risk. Temporary workarounds are available, but they do not replace the need for an update.
See every vulnerability recorded for squid →
FAQ
CVE-2019-12519 is a critical vulnerability in the Squid package that can lead to buffer overflow and potential arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2019-12519 is 9.8, indicating a critical severity level.
If immediate updates are not possible, consider disabling ESI processing in your Squid configuration as a temporary workaround.
You can find more information about Squid vulnerabilities and updates on the official Squid website and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
