CVE-2015-0881: CRLF Injection
Published Feb 20, 2015
·Updated
CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.
Affected Software
1 affected component
Squid-Cache Squid<=3.1.0.18
Event History
Feb 20, 2015
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-0881?
CVE-2015-0881 is classified as a high severity vulnerability due to its potential for HTTP response splitting attacks.
2
How do I fix CVE-2015-0881?
The recommended fix for CVE-2015-0881 is to upgrade Squid to version 3.1.1 or higher.
3
What systems are affected by CVE-2015-0881?
CVE-2015-0881 affects Squid versions prior to 3.1.1, specifically all versions up to and including 3.1.0.18.
4
What type of attack can be executed using CVE-2015-0881?
CVE-2015-0881 allows remote attackers to conduct HTTP response splitting attacks by injecting arbitrary HTTP headers.
5
Is CVE-2015-0881 easy to exploit?
Yes, CVE-2015-0881 can be exploited easily by sending specially crafted headers in an HTTP response.