Bug 156703

Summary:	CAN-2005-1389 HTTP Response Splitting Vulnerabilities
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	squid	Assignee:	Jay Fenlason <fenlason>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	medium
Version:	3	CC:	jfeeney
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=low,public=20050423,source=cve,reported=20050502
Fixed In Version:	7:2.5.STABLE8-1.FC3.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-05-16 18:46:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2005-05-03 14:47:31 UTC

+++ This bug was initially created as a clone of Bug #156699 +++

Squid is susceptible to a class of attacks known as "HTTP Response
Splitting."  These attacks involve tricking servers into sending
malformed or unexpected HTTP responses by exploiting weaknesses
in input validation on dynamic pages. This may in some situations
lead to cache poisoning.

http://www.squid-cache.org/Advisories/SQUID-2005_5.txt