Bugzilla – Bug 1113668
VUL-0: CVE-2018-19131: squid: Cross-Site Scripting vulnerability in the TLS error handling
Last modified: 2022-10-13 13:49:23 UTC
* An Cross-Site Scripting vulnerability (CWE-74, CWE-79) has been found in the TLS error handling by Squid. Several fields of X.509 certificates can contain HTML syntax and were not being correctly quoted/encoded before inserting into HTML error pages generated by the proxy. This issue allows an attacker to craft a X.509 certificate that both triggers an error and alters how that error is displayed by a client such as a Browser. Affected Versions: Squid 3.1.12.1 -> 3.1.23 Squid 4.0 -> 4.3 Squid 3.1.12 and older including Squid-2.x are not vulnerable. The patch for Squid-3.5 should apply relatively cleanly to all v3.x affected versions. <http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-f1657a9decc820f748fa3aff68168d3145258031.patch> <http://www.squid-cache.org/Versions/v4/changesets/squid-4-828245b90206602014ce057c3db39fb80fcc4b08.patch> <http://www.squid-cache.org/Versions/v5/changesets/squid-5-6feeb15ff312f3e145763adf8d234ed6a0b3f11d.patch> <http://www.squid-cache.org/Advisories/SQUID-2018_4.txt>
This does not have CVEs yet, although they were requested according to the oss-sec thread. Also, this has been added: > Apologies, these versions are also affected: > > Squid 3.2.0.4 -> 3.5.28
Fixes ready, pending CVE numbers.
Requested CVE Mitre, let's see if they are willing to assign one for this, since nothing is happening on the DWF front.
Mitre was really fast here: CVE-2018-19131
Fixes submitted to all affected codestreams. Reassigning to security team
SUSE-SU-2018:3771-1: An update that solves two vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1082318,1112066,1112695,1113668,1113669 CVE References: CVE-2018-19131,CVE-2018-19132 Sources used: SUSE Linux Enterprise Server 12-SP3 (src): squid-3.5.21-26.12.1
SUSE-SU-2018:3786-1: An update that solves two vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1082318,1112066,1112695,1113668,1113669 CVE References: CVE-2018-19131,CVE-2018-19132 Sources used: SUSE Linux Enterprise Module for Server Applications 15 (src): squid-4.4-5.3.2
SUSE-SU-2018:3790-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1113668 CVE References: CVE-2018-19131 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): squid3-3.1.23-8.16.37.9.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): squid3-3.1.23-8.16.37.9.1
openSUSE-SU-2018:3818-1: An update that solves two vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1082318,1112066,1112695,1113668,1113669 CVE References: CVE-2018-19131,CVE-2018-19132 Sources used: openSUSE Leap 15.0 (src): squid-4.4-lp150.4.3.2
openSUSE-SU-2018:3825-1: An update that solves two vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1082318,1112066,1112695,1113668,1113669 CVE References: CVE-2018-19131,CVE-2018-19132 Sources used: openSUSE Leap 42.3 (src): squid-3.5.21-18.1
SUSE-SU-2018:3771-2: An update that solves two vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1082318,1112066,1112695,1113668,1113669 CVE References: CVE-2018-19131,CVE-2018-19132 Sources used: SUSE Linux Enterprise Server 12-SP4 (src): squid-3.5.21-26.12.1
This is an autogenerated message for OBS integration: This bug (1113668) was mentioned in https://build.opensuse.org/request/show/701549 Factory / squid
SLE12 has reached its end-of-life. Resolved.