Vulnerability in Squid Package: CVE-2019-12525
Summary
CVE-2019-12525: An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. Affects squid across 3 version ranges.
< 2e17b02616d37206ba9cccc53c20667624fbef9f
< 4.8-r0
>= 83f1f03412750fdd98b5219ff5829cd4e319a1b3, <= 6cfeb300caf423ff49a0511d8bd43a56f3418273
Fixed in 4.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a popular caching proxy server that provides improved performance and security for web clients. It is widely used to enhance the speed and reliability of web applications. However, a vulnerability has been discovered in Squid versions 3.3.9 through 3.5.28 and 4.x through 4.7. This vulnerability affects Squid when configured to use Digest authentication. It involves a parsing issue in the Proxy-Authorization header, which can lead to a memory corruption vulnerability.
Vulnerability Detail
The vulnerability (CVE-2019-12525) in Squid arises from a flaw in the parsing of the Proxy-Authorization header. When Squid is configured to use Digest authentication, it searches for specific tokens such as domain, uri, and qop. However, it fails to properly validate the value of these tokens, leading to a memory corruption vulnerability. An attacker can exploit this vulnerability by crafting a malicious request that triggers the flawed parsing logic, potentially resulting in remote code execution or denial of service.
How To Fix
Minimum fixed version
4.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Squid immediately is not feasible, a temporary workaround can be implemented by disabling Digest authentication or using an alternative authentication method. However, it is important to note that these workarounds may impact the functionality and security of the Squid server. It is strongly advised to update to the latest version as soon as possible.
Conclusion
The vulnerability in Squid (CVE-2019-12525) poses a significant risk to the security and stability of Squid servers. It is crucial to update to the latest version of Squid (4.8-r0 or later) to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for squid →
FAQ
Squid is a caching proxy server that improves the performance and security of web applications by caching frequently accessed content.
Squid versions 3.3.9 through 3.5.28 and 4.x through 4.7 are affected by this vulnerability.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service on a vulnerable Squid server.
To fix this vulnerability, update Squid to version 4.8-r0 or later.
A temporary workaround is to disable Digest authentication or use an alternative authentication method, but it is recommended to update to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
