CVE-2019-18677
Summary
| CVE | CVE-2019-18677 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-11-26 17:15:00 UTC |
|---|
| Updated | 2023-11-07 03:06:00 UTC |
|---|
| Description | An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Prevent truncation for large origin-relative domains by yadij · Pull Request #427 · squid-cache/squid · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| [SECURITY] [DLA 2278-1] squid3 security update |
MLIST |
lists.debian.org |
|
| Bug 1156328 – VUL-0: CVE-2019-18677: squid,squid3: incorrect message processing can lead to inappropriately redirect traffic |
CONFIRM |
bugzilla.suse.com |
Issue Tracking, Third Party Advisory |
| [SECURITY] Fedora 30 Update: squid-4.9-2.fc30 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-e5f1813a674848dde570f792... |
CONFIRM |
www.squid-cache.org |
Release Notes |
| USN-4213-1: Squid vulnerabilities | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
Third Party Advisory |
| [SECURITY] Fedora 31 Update: squid-4.9-2.fc31 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] [DLA 2028-1] squid3 security update |
MLIST |
lists.debian.org |
Third Party Advisory |
| [SECURITY] Fedora 31 Update: squid-4.9-2.fc31 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| Debian -- Security Information -- DSA-4682-1 squid |
DEBIAN |
www.debian.org |
|
| [SECURITY] Fedora 30 Update: squid-4.9-2.fc30 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| www.squid-cache.org/Versions/v4/changesets/squid-4-36492033ea4097821a4f7ff3ddcb97... |
CONFIRM |
www.squid-cache.org |
Release Notes |
| www.squid-cache.org/Advisories/SQUID-2019_9.txt |
CONFIRM |
www.squid-cache.org |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159658 Oracle Enterprise Linux Security Update for squid:4 (ELSA-2020-4743)
- 296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
- 356430 Amazon Linux Security Advisory for squid : ALAS2-2023-2318
- 377360 Alibaba Cloud Linux Security Update for squid:4 (ALINUX3-SA-2022:0124)
- 670223 EulerOS Security Update for squid (EulerOS-SA-2021-1852)
- 940034 AlmaLinux Security Update for squid:4 (ALSA-2020:4743)
- 960867 Rocky Linux Security Update for squid:4 (RLSA-2020:4743)
