Bugzilla – Bug 1141329
VUL-1: CVE-2019-12529: squid, squid3: When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uu
Last modified: 2022-10-18 09:31:16 UTC
CVE-2019-12529 An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12529 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12529.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12529 http://www.squid-cache.org/Versions/v4/changesets/ http://www.squid-cache.org/Versions/v4/changesets/squid-4-dd46b5417809647f561d8a5e0e74c3aacd235258.patch https://github.com/squid-cache/squid/commits/v4
This is an autogenerated message for OBS integration: This bug (1141329) was mentioned in https://build.opensuse.org/request/show/715608 Factory / squid
http://www.squid-cache.org/Advisories/SQUID-2019_2.txt
This is an autogenerated message for OBS integration: This bug (1141329) was mentioned in https://build.opensuse.org/request/show/715745 Factory / squid
SUSE-SU-2019:2089-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1140738,1141329,1141332 CVE References: CVE-2019-12525,CVE-2019-12529,CVE-2019-13345 Sources used: SUSE OpenStack Cloud 8 (src): squid-3.5.21-26.17.1 SUSE OpenStack Cloud 7 (src): squid-3.5.21-26.17.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): squid-3.5.21-26.17.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): squid-3.5.21-26.17.1 SUSE Linux Enterprise Server 12-SP4 (src): squid-3.5.21-26.17.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): squid-3.5.21-26.17.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): squid-3.5.21-26.17.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): squid-3.5.21-26.17.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): squid-3.5.21-26.17.1 SUSE Enterprise Storage 5 (src): squid-3.5.21-26.17.1 SUSE Enterprise Storage 4 (src): squid-3.5.21-26.17.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2089-2: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1140738,1141329,1141332 CVE References: CVE-2019-12525,CVE-2019-12529,CVE-2019-13345 Sources used: SUSE OpenStack Cloud Crowbar 8 (src): squid-3.5.21-26.17.1 SUSE Enterprise Storage 5 (src): squid-3.5.21-26.17.1 HPE Helion Openstack 8 (src): squid-3.5.21-26.17.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2975-1: An update that fixes 12 vulnerabilities is now available. Category: security (important) Bug References: 1133089,1140738,1141329,1141330,1141332,1141442,1156323,1156324,1156326,1156328,1156329 CVE References: CVE-2019-12523,CVE-2019-12525,CVE-2019-12526,CVE-2019-12527,CVE-2019-12529,CVE-2019-12854,CVE-2019-13345,CVE-2019-18676,CVE-2019-18677,CVE-2019-18678,CVE-2019-18679,CVE-2019-3688 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): squid-4.9-5.11.1 SUSE Linux Enterprise Module for Server Applications 15 (src): squid-4.9-5.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2540-1: An update that fixes 12 vulnerabilities is now available. Category: security (important) Bug References: 1133089,1140738,1141329,1141330,1141332,1141442,1156323,1156324,1156326,1156328,1156329 CVE References: CVE-2019-12523,CVE-2019-12525,CVE-2019-12526,CVE-2019-12527,CVE-2019-12529,CVE-2019-12854,CVE-2019-13345,CVE-2019-18676,CVE-2019-18677,CVE-2019-18678,CVE-2019-18679,CVE-2019-3688 Sources used: openSUSE Leap 15.0 (src): squid-4.9-lp150.13.1
openSUSE-SU-2019:2541-1: An update that fixes 12 vulnerabilities is now available. Category: security (important) Bug References: 1133089,1140738,1141329,1141330,1141332,1141442,1156323,1156324,1156326,1156328,1156329 CVE References: CVE-2019-12523,CVE-2019-12525,CVE-2019-12526,CVE-2019-12527,CVE-2019-12529,CVE-2019-12854,CVE-2019-13345,CVE-2019-18676,CVE-2019-18677,CVE-2019-18678,CVE-2019-18679,CVE-2019-3688 Sources used: openSUSE Leap 15.1 (src): squid-4.9-lp151.2.7.1
SUSE-SU-2020:14460-1: An update that fixes 21 vulnerabilities is now available. Category: security (important) Bug References: 1140738,1141329,1141332,1156323,1156324,1156326,1156328,1156329,1162687,1162689,1162691,1167373,1169659,1170313,1170423,1173304,1173455 CVE References: CVE-2019-12519,CVE-2019-12520,CVE-2019-12521,CVE-2019-12523,CVE-2019-12524,CVE-2019-12525,CVE-2019-12526,CVE-2019-12528,CVE-2019-12529,CVE-2019-13345,CVE-2019-18676,CVE-2019-18677,CVE-2019-18678,CVE-2019-18679,CVE-2019-18860,CVE-2020-11945,CVE-2020-14059,CVE-2020-15049,CVE-2020-8449,CVE-2020-8450,CVE-2020-8517 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): squid3-3.1.23-8.16.37.12.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): squid3-3.1.23-8.16.37.12.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): squid3-3.1.23-8.16.37.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Fixes should be submitted to all active codestreams. Reassigning to security-team.