First published: Tue Nov 26 2019(Updated: )
An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Squid-Cache Squid | >=3.0<=3.5.28 | |
Squid-Cache Squid | >=4.0<=4.8 | |
Canonical Ubuntu Linux | =16.04 | |
Canonical Ubuntu Linux | =18.04 | |
Canonical Ubuntu Linux | =19.04 | |
Canonical Ubuntu Linux | =19.10 | |
Debian Debian Linux | =8.0 | |
Fedoraproject Fedora | =30 | |
Fedoraproject Fedora | =31 | |
debian/squid | 4.13-10+deb11u3 5.7-2+deb12u2 6.12-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2019-18678 is medium with a severity value of 5.3.
CVE-2019-18678 affects Squid versions 3.x and 4.x through 4.8.
CVE-2019-18678 allows attackers to smuggle HTTP requests through frontend software to a Squid instance, corrupting caches with attacker-controlled data.
To fix CVE-2019-18678 on Ubuntu, update the Squid package to version 4.9-2ubuntu1 or higher.
To fix CVE-2019-18678 on Debian, update the Squid package to version 4.6-1+deb10u7 or higher.