CVE-2019-18678: Medium severity Squid-Cache Squid vulnerability
An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18678?
The severity of CVE-2019-18678 is medium with a severity value of 5.3.
How does CVE-2019-18678 affect Squid?
CVE-2019-18678 affects Squid versions 3.x and 4.x through 4.8.
What is the impact of CVE-2019-18678?
CVE-2019-18678 allows attackers to smuggle HTTP requests through frontend software to a Squid instance, corrupting caches with attacker-controlled data.
How can I fix CVE-2019-18678 on Ubuntu?
To fix CVE-2019-18678 on Ubuntu, update the Squid package to version 4.9-2ubuntu1 or higher.
How can I fix CVE-2019-18678 on Debian?
To fix CVE-2019-18678 on Debian, update the Squid package to version 4.6-1+deb10u7 or higher.