CVE-2020-25097: Input Validation
An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uriwhitespace configuration settings.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-25097?
CVE-2020-25097 is an issue discovered in Squid that allows a trusted client to perform HTTP Request Smuggling and access forbidden services.
What is the severity of CVE-2020-25097?
The severity of CVE-2020-25097 is high, with a severity value of 8.6.
What is the affected software for CVE-2020-25097?
The affected software for CVE-2020-25097 includes Squid versions 4.13 and 5.x through 5.0.4.
How can I fix CVE-2020-25097?
To fix CVE-2020-25097, update your Squid installation to version 4.6-1+deb10u7, 4.6-1+deb10u8, 4.13-10+deb11u2, 5.7-2, or 6.3-1, depending on your operating system.
Where can I find more information about CVE-2020-25097?
More information about CVE-2020-25097 can be found on the MITRE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25097), the Squid security advisories page on GitHub (https://github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6), and the Ubuntu security notices page (https://ubuntu.com/security/notices/USN-4895-1).