CVE-2019-12527: Buffer Overflow
An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.
Reference: https://github.com/squid-cache/squid/commits/v4 http://www.squid-cache.org/Versions/v4/changesets/
Upstream Patch: http://www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patch
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/squidto a version that resolves this vulnerability.Fixed in 4.8 - Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 4.13-10+deb11u3Fixed in 4.13-10+deb11u6Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u4Fixed in 6.13-2+deb13u1Fixed in 7.4-1 - Upgrade
Upgrade
Squidto a version that resolves this vulnerability.Patch 7f73e9c5d17664b882ed32590e6af310c247f320
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12527?
The severity of CVE-2019-12527 is high (8.8).
How does CVE-2019-12527 impact Squid?
CVE-2019-12527 can lead to a heap-based buffer overflow in Squid.
Which versions of Squid are affected by CVE-2019-12527?
Squid versions 4.0.23 through 4.7 are affected by CVE-2019-12527.
How can I fix CVE-2019-12527?
Upgrade to Squid version 4.8 or apply the necessary patches provided by the vendor.
Where can I find more information about CVE-2019-12527?
You can find more information about CVE-2019-12527 on the official Squid website and the GitHub repository of Squid.