7.5

CVE-2019-18679

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.

Data is provided by the National Vulnerability Database (NVD)
Squid-cache ≫ Squid Version >= 2.0 <= 2.7
Squid-cache ≫ Squid Version >= 3.0 <= 3.5.28
Squid-cache ≫ Squid Version >= 4.0 <= 4.8
Squid-cache ≫ Squid Version2.7 Updatestable2
Squid-cache ≫ Squid Version2.7 Updatestable3
Squid-cache ≫ Squid Version2.7 Updatestable4
Squid-cache ≫ Squid Version2.7 Updatestable5
Squid-cache ≫ Squid Version2.7 Updatestable6
Squid-cache ≫ Squid Version2.7 Updatestable7
Squid-cache ≫ Squid Version2.7 Updatestable8
Squid-cache ≫ Squid Version2.7 Updatestable9
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version19.04
Canonical ≫ Ubuntu Linux Version19.10
Debian ≫ Debian Linux Version8.0
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 38.43% 0.971
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://usn.ubuntu.com/4213-1/
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1156324
Third Party Advisory
Issue Tracking