Bug 1827558 (CVE-2019-12520)

Summary: CVE-2019-12520 squid: Improper input validation in request allows for proxy manipulation
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anon.amish, code, jonathansteffan, luhliari, uwe.knop
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: squid 4.8 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in squid. The absolute URL of a request can include the decoded UserInfo (username and password) for certain protocols. This decoded info may contain special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-04 02:25:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1828374, 1828377    
Bug Blocks: 1827553    

Description Marian Rehak 2020-04-24 08:10:58 UTC 
The absolute URL of a request can include the decoded UserInfo (username and password) for certain protocols. This decoded info may contain special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.
Comment 1 Marian Rehak 2020-04-24 08:11:17 UTC 
Upstream Issue:

https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12520.txt
Comment 2 Stefan Cornelius 2020-04-24 11:59:33 UTC 
Patch:
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2019_4.patch
Comment 3 Stefan Cornelius 2020-04-24 11:59:38 UTC 
External References:

http://www.squid-cache.org/Advisories/SQUID-2019_4.txt
Comment 6 Product Security DevOps Team 2020-11-04 02:25:02 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-12520
Comment 7 errata-xmlrpc 2020-11-04 03:32:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4743 https://access.redhat.com/errata/RHSA-2020:4743