Sensitive Information Disclosure in Squid Package - CVE-2019-12528
Summary
ALPINE-CVE-2019-12528: An issue was discovered in Squid before 4.10. Affects squid versions < 4.10-r0. Fixed in 4.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching proxy for the web supporting HTTP, HTTPS, FTP, and more. It is designed to improve web performance by caching frequently requested content and reducing bandwidth usage. However, it has been found to have a vulnerability that allows unauthorized access to sensitive information from heap memory, potentially affecting user sessions and other processes.
Vulnerability Detail
An issue was discovered in Squid before version 4.10, where a crafted FTP server could trigger the disclosure of sensitive information from heap memory. This could include data associated with other users' sessions or non-Squid processes, leading to potential privacy breaches and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
4.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the FTP server or disabling FTP support in Squid until the package can be updated to the patched version.
Conclusion
CVE-2019-12528 presents a significant risk to users of the Squid package, allowing unauthorized access to sensitive information. It is crucial to update to the patched version to mitigate this risk. Users should also consider temporary workarounds while preparing for the update.
See every vulnerability recorded for squid →
FAQ
CVE-2019-12528 is a vulnerability in Squid that allows a crafted FTP server to disclose sensitive information from heap memory.
Versions of Squid prior to 4.10 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2019-12528 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing access restrictions to the FTP server or disabling FTP support in Squid as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
