QID 356277

an issue was discovered in squid before 4.9.
When handling a urn request, a corresponding http request is made.
This http request doesnt go through the access checks that incoming http requests go through.
This causes all access checks to be bypassed and allows access to restricted http servers, e.g., an attacker can connect to http servers that only listen on localhost. (
( CVE-2019-12523) an issue was discovered in squid 3.3.9 through 3.5.28 and 4.x through 4.7.
When squid is configured to use digest authentication, it parses the header proxy-authorization.
It searches for certain tokens such as domain, uri, and qop.
Squid checks if this tokens value starts with a quote and ends with one.
If so, it performs a memcpy of its length minus 2.
Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1. (
( CVE-2019-12525) an issue was discovered in squid before 4.9.
Urn response handling in squid suffers from a heap-based buffer overflow.
When receiving data from a remote server in response to an urn request, squid fails to ensure that the response can fit within the buffer.
This leads to attacker controlled data overflowing in the heap. (
( CVE-2019-12526) an issue was discovered in squid 3.x and 4.x through 4.8.
Due to incorrect input validation, there is a heap-based buffer overflow that can result in denial of service to all clients using the proxy.
Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted uri scheme. (
( CVE-2019-18678)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.