Due to incorrect message parsing Squid is vulnerable to an HTTP request splitting issue. This issue allows attackers to smuggle HTTP requests through frontend software to a Squid which splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between client and Squid with attacker controlled content at arbitrary URLs. References: http://www.squid-cache.org/Advisories/SQUID-2019_10.txt
Created squid tracking bugs for this issue: Affects: fedora-all [bug 1770350]
Upstream patch: http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patch
External References: http://www.squid-cache.org/Advisories/SQUID-2019_10.txt
Hi Could anyone please clarify, whether a patch for Squid V3 will be released for this issue? Thanks, Serhii
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-18678
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4743 https://access.redhat.com/errata/RHSA-2020:4743