CVE-2019-12521: Medium severity Squid-Cache Squid vulnerability
An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-12521?
CVE-2019-12521 is a vulnerability discovered in Squid through 4.7 that allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
What is the severity of CVE-2019-12521?
The severity of CVE-2019-12521 is medium, with a CVSS score of 5.9.
How does CVE-2019-12521 affect Squid?
CVE-2019-12521 affects Squid versions up to 4.7.
How can I fix CVE-2019-12521?
To fix CVE-2019-12521, it is recommended to upgrade Squid to version 4.8 or later.
Where can I find more information about CVE-2019-12521?
More information about CVE-2019-12521 can be found at the following references: [Link 1](https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12521.txt), [Link 2](http://www.openwall.com/lists/oss-security/2020/04/23/1), [Link 3](https://www.debian.org/security/2020/dsa-4682).