Information Disclosure Vulnerability in Squid Package: CVE-2019-18679
Summary
ALPINE-CVE-2019-18679: An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Affects squid versions < 4.8-r1. Fixed in 4.8-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching and forwarding HTTP web proxy that supports various protocols, including HTTP, HTTPS, and FTP. It is designed to improve web performance by caching frequently requested resources, thus reducing bandwidth and improving response times. However, Squid versions 2.x, 3.x, and 4.x through 4.8 are vulnerable to an information disclosure issue due to improper data management when processing HTTP Digest Authentication.
Vulnerability Detail
The vulnerability arises from the way Squid handles nonce tokens during HTTP Digest Authentication. These tokens inadvertently expose raw byte values of pointers from heap memory allocations. This exposure can undermine Address Space Layout Randomization (ASLR) protections, potentially allowing attackers to isolate memory areas for remote code execution attacks. The severity of this vulnerability is rated at a CVSS score of 7.5, indicating a high risk of exploitation.
How To Fix
Minimum fixed version
4.8-r1
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling HTTP Digest Authentication until the package can be updated. This can be done by modifying the Squid configuration file (usually located at /etc/squid/squid.conf) to use a different authentication method.
Conclusion
The CVE-2019-18679 vulnerability in the Squid package poses a significant risk due to improper handling of nonce tokens, which can lead to information disclosure and potential remote code execution. It is crucial to update to the patched versions of Squid to mitigate this risk.
See every vulnerability recorded for squid →
FAQ
CVE-2019-18679 is a vulnerability in the Squid package that allows for information disclosure through improper handling of nonce tokens in HTTP Digest Authentication.
Squid versions 2.x, 3.x, and 4.x up to 4.8 are affected by this vulnerability.
The vulnerability can lead to information disclosure that may assist attackers in executing remote code execution attacks by isolating memory areas.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2019-18679 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
