CVE-2019-12519: Critical severity Squid-Cache Squid vulnerability
An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-12519?
CVE-2019-12519 is a vulnerability discovered in Squid through version 4.7.
What is the severity of CVE-2019-12519?
CVE-2019-12519 has a severity rating of 9.8 out of 10.
How does CVE-2019-12519 affect Squid?
CVE-2019-12519 affects Squid when handling the esi:when tag and ESI is enabled.
What is the fix for CVE-2019-12519?
To fix CVE-2019-12519, upgrade Squid to version 4.8-1ubuntu2.3 (for Ubuntu) or 4.13-10+deb11u2 (for Debian) depending on your operating system.
Where can I find more information about CVE-2019-12519?
More information about CVE-2019-12519 can be found at the following links: [Link1](https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12519.txt), [Link2](http://www.openwall.com/lists/oss-security/2020/04/23/1), [Link3](https://www.debian.org/security/2020/dsa-4682).