CVE-2019-18678
Summary
| CVE | CVE-2019-18678 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-11-26 17:15:00 UTC |
|---|
| Updated | 2023-11-07 03:06:00 UTC |
|---|
| Description | An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] [DLA 2278-1] squid3 security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 30 Update: squid-4.9-2.fc30 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| Squid: Multiple vulnerabilities (GLSA 202003-34) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad2... |
CONFIRM |
www.squid-cache.org |
Release Notes |
| RFC 7230: server MUST reject messages with BWS after field-name by yadij · Pull Request #445 · squid-cache/squid · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Bug 1156323 – VUL-0: CVE-2019-18678: squid,squid3: incorrect message parsing leads to HTTP request splitting issue |
CONFIRM |
bugzilla.suse.com |
Issue Tracking, Third Party Advisory |
| USN-4213-1: Squid vulnerabilities | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
Third Party Advisory |
| [SECURITY] Fedora 31 Update: squid-4.9-2.fc31 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] [DLA 2028-1] squid3 security update |
MLIST |
lists.debian.org |
Third Party Advisory |
| [SECURITY] Fedora 31 Update: squid-4.9-2.fc31 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| Debian -- Security Information -- DSA-4682-1 squid |
DEBIAN |
www.debian.org |
|
| [SECURITY] Fedora 30 Update: squid-4.9-2.fc30 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| www.squid-cache.org/Advisories/SQUID-2019_10.txt |
CONFIRM |
www.squid-cache.org |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159658 Oracle Enterprise Linux Security Update for squid:4 (ELSA-2020-4743)
- 296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
- 356277 Amazon Linux Security Advisory for squid : ALASSQUID4-2023-007
- 356430 Amazon Linux Security Advisory for squid : ALAS2-2023-2318
- 377360 Alibaba Cloud Linux Security Update for squid:4 (ALINUX3-SA-2022:0124)
- 940034 AlmaLinux Security Update for squid:4 (ALSA-2020:4743)
- 960867 Rocky Linux Security Update for squid:4 (RLSA-2020:4743)
