Bug 1798540 (CVE-2020-8449) - CVE-2020-8449 squid: Improper input validation issues in HTTP Request processing
Summary: CVE-2020-8449 squid: Improper input validation issues in HTTP Request processing
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-8449
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1798541 1802514 1802516 1836854
Blocks: 1798558
TreeView+ depends on / blocked
 
Reported: 2020-02-05 14:59 UTC by Pedro Sampaio
Modified: 2023-12-15 17:16 UTC (History)
12 users (show)

Fixed In Version: squid 4.10
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in squid. Due to incorrect input validation, squid can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
Clone Of:
Environment:
Last Closed: 2020-09-30 09:57:12 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4082 0 None None None 2020-09-30 07:00:58 UTC
Red Hat Product Errata RHSA-2020:4743 0 None None None 2020-11-04 03:31:56 UTC

Description Pedro Sampaio 2020-02-05 14:59:58 UTC 
An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.

References:

http://www.squid-cache.org/Advisories/SQUID-2020_1.txt 	
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch 	
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8e657e835965c3a011375feaa0359921c5b3e2dd.patch 	
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_1.patch 	
http://www.squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch 	
http://www.squid-cache.org/Versions/v4/changesets/squid-4-d8e4715992d0e530871519549add5519cbac0598.patch
Comment 1 Pedro Sampaio 2020-02-05 15:00:39 UTC 
Created squid tracking bugs for this issue:

Affects: fedora-all [bug 1798541]
Comment 4 Stefan Cornelius 2020-05-26 19:12:33 UTC 
Statement:

This only affects deployments acting as reverse proxy with a http_port 'accel' or 'vhost' (squid 2.x and 3.x) or http_port 'accel' configuration (squid 4.x).
Comment 9 errata-xmlrpc 2020-09-30 07:00:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4082 https://access.redhat.com/errata/RHSA-2020:4082
Comment 10 Product Security DevOps Team 2020-09-30 09:57:12 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-8449
Comment 11 errata-xmlrpc 2020-11-04 03:31:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4743 https://access.redhat.com/errata/RHSA-2020:4743
Note You need to log in before you can comment on or make changes to this bug.