5.9

CVE-2019-12529

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Squid-cache ≫ Squid Version >= 2.0 < 2.7
Squid-cache ≫ Squid Version >= 3.0 <= 3.5.28
Squid-cache ≫ Squid Version >= 4.0 <= 4.7
Squid-cache ≫ Squid Version 2.7 Update stable1
Squid-cache ≫ Squid Version 2.7 Update stable2
Squid-cache ≫ Squid Version 2.7 Update stable3
Squid-cache ≫ Squid Version 2.7 Update stable4
Squid-cache ≫ Squid Version 2.7 Update stable5
Squid-cache ≫ Squid Version 2.7 Update stable6
Squid-cache ≫ Squid Version 2.7 Update stable7
Squid-cache ≫ Squid Version 2.7 Update stable8
Squid-cache ≫ Squid Version 2.7 Update stable9
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Fedoraproject ≫ Fedora Version 29
Opensuse ≫ Leap Version 15.0
Opensuse ≫ Leap Version 15.1
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition -
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 19.04
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.09% 0.941
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/
https://seclists.org/bugtraq/2019/Aug/42
Third Party Advisory
Mailing List
https://www.debian.org/security/2019/dsa-4507
Third Party Advisory
http://www.squid-cache.org/Versions/v4/changesets/
Vendor Advisory
https://github.com/squid-cache/squid/commits/v4
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00018.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4065-1/
Third Party Advisory
https://usn.ubuntu.com/4065-2/
Third Party Advisory
http://www.squid-cache.org/Versions/v4/changesets/squid-4-dd46b5417809647f561d8a5e0e74c3aacd235258.patch
Patch
Vendor Advisory