CVE-2019-12527: Buffer Overflow
An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.
Reference: https://github.com/squid-cache/squid/commits/v4 http://www.squid-cache.org/Versions/v4/changesets/
Upstream Patch: http://www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patch
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12527?
The severity of CVE-2019-12527 is high (8.8).
How does CVE-2019-12527 impact Squid?
CVE-2019-12527 can lead to a heap-based buffer overflow in Squid.
Which versions of Squid are affected by CVE-2019-12527?
Squid versions 4.0.23 through 4.7 are affected by CVE-2019-12527.
How can I fix CVE-2019-12527?
Upgrade to Squid version 4.8 or apply the necessary patches provided by the vendor.
Where can I find more information about CVE-2019-12527?
You can find more information about CVE-2019-12527 on the official Squid website and the GitHub repository of Squid.