medium
5.9
CWE
125
Advisory Published
Updated

CVE-2019-12529

First published: Thu Jul 11 2019(Updated: )

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Squid-Cache Squid>=2.0<2.7
Squid-Cache Squid>=3.0<=3.5.28
Squid-Cache Squid>=4.0<=4.7
Squid-Cache Squid=2.7-stable1
Squid-Cache Squid=2.7-stable2
Squid-Cache Squid=2.7-stable3
Squid-Cache Squid=2.7-stable4
Squid-Cache Squid=2.7-stable5
Squid-Cache Squid=2.7-stable6
Squid-Cache Squid=2.7-stable7
Squid-Cache Squid=2.7-stable8
Squid-Cache Squid=2.7-stable9
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Fedoraproject Fedora=29
openSUSE Leap=15.0
openSUSE Leap=15.1
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.04
debian/squid
4.13-10+deb11u3
5.7-2+deb12u2
6.10-1

Remedy

http://www.squid-cache.org/Versions/v4/changesets/squid-4-dd46b5417809647f561d8a5e0e74c3aacd235258.patch

Remedy

https://github.com/squid-cache/squid/commits/v4

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2019-12529?

    The severity of CVE-2019-12529 is medium.

  • How does CVE-2019-12529 affect Squid?

    CVE-2019-12529 affects Squid versions 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7.

  • How is Proxy-Authorization header parsed in Squid?

    Proxy-Authorization header is parsed via uudecode in Squid.

  • What is the recommended remedy for CVE-2019-12529 on Ubuntu?

    The recommended remedy for CVE-2019-12529 on Ubuntu is to update to the latest version of squid or squid3.

  • Where can I find more information about CVE-2019-12529?

    You can find more information about CVE-2019-12529 at the official website of Squid and the security announcement links provided.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203