First Last Prev Next    This bug is not in your last search results.
Bug 1173455 - (CVE-2020-15049) VUL-0: CVE-2020-15049: squid: multiple Cache Poisoning Issue in HTTP Request processing
(CVE-2020-15049)
VUL-0: CVE-2020-15049: squid: multiple Cache Poisoning Issue in HTTP Request ...
Status: NEW
: 1174381 (view as bug list)
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/262470/
CVSSv3.1:SUSE:CVE-2020-15049:8.5:(AV:...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2020-06-29 06:59 UTC by Robert Frohl
Modified: 2022-10-18 09:37 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2020-06-29 06:59:40 UTC 
Problem Description:

Due to incorrect input validation Squid is vulnerable to a Request Smuggling and
Poisoning attack against the HTTP cache.
Severity:

This problem allows a trusted client to perform request smuggling and poison the
HTTP cache contents with crafted HTTP(S) request messages.

This attack requires an upstream server to participate in the smuggling and
generate the poison response sequence. Most popular server software are not
vulnerable to participation in this attack.

CVSS Score of 9.3
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:L/MUI:N/MS:C/MC:H/MI:H/MA:H&version=3.1
Updated Packages:
This bug is fixed by Squid versions 4.12 and 5.0.3.

In addition, patches addressing this problem for the stable
releases can be found in our patch archives:
Squid 4:

http://www.squid-cache.org/Versions/v4/changesets/squid-4-ea12a34d338b962707d5078d6d1fc7c6eb119a22.patch
Squid 5:

http://www.squid-cache.org/Versions/v5/changesets/squid-5-485c9a7bb1bba88754e07ad0094647ea57a6eb8d.patch

If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.
Determining if your version is vulnerable:

All Squid-2.x up to and including 2.7.STABLE9 are vulnerable.

All Squid-3.x up to and including 3.5.28 are vulnerable.

All Squid-4.x up to and including 4.11 are vulnerable.

Squid-5.0.1 and 5.0.2 are vulnerable.
Workaround:

There is no workaround for this vulnerability.
Contact details for the Squid project:

For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.

If you install and build Squid from the original Squid sources
then the squid-users@lists.squid-cache.org mailing list is your
primary support point. For subscription details see
http://www.squid-cache.org/Support/mailing-lists.html.

For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
http://bugs.squid-cache.org/.

For reporting of security sensitive bugs send an email to the
squid-bugs@lists.squid-cache.org mailing list. It's a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.
Credits:

This vulnerability was discovered by Alex Rousskov of The Measurement Factory.

Independent discovery and replication reported by Amit Klein of Safebreach.

Fixed by Alex Rousskov of The Measurement Factory.
Revision history:

2016-09-06 02:45:20 UTC Initial Report
2020-05-11 12:41:17 UTC Replication Reported
2020-05-13 14:05:00 UTC Patch Released
2020-06-25 11:15:10 UTC CVE Allocated

from https://github.com/squid-cache/squid/security/advisories/GHSA-qf3v-rc95-96j5
Comment 1 OBSbugzilla Bot 2020-06-29 08:40:06 UTC 
This is an autogenerated message for OBS integration:
This bug (1173455) was mentioned in
https://build.opensuse.org/request/show/817633 Factory / squid
Comment 2 Alexandros Toptsoglou 2020-07-02 14:26:09 UTC 
Tracked SLE11 and SLE12-SP2 as affected. SLE15 and SLE12-SP5 ship an already fixed version
Comment 4 Swamp Workflow Management 2020-07-17 16:20:14 UTC 
SUSE-SU-2020:1946-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1173455
CVE References: CVE-2020-15049
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    squid-3.5.21-26.29.1
SUSE OpenStack Cloud Crowbar 8 (src):    squid-3.5.21-26.29.1
SUSE OpenStack Cloud 9 (src):    squid-3.5.21-26.29.1
SUSE OpenStack Cloud 8 (src):    squid-3.5.21-26.29.1
SUSE OpenStack Cloud 7 (src):    squid-3.5.21-26.29.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    squid-3.5.21-26.29.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    squid-3.5.21-26.29.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    squid-3.5.21-26.29.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    squid-3.5.21-26.29.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    squid-3.5.21-26.29.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    squid-3.5.21-26.29.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    squid-3.5.21-26.29.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    squid-3.5.21-26.29.1
SUSE Enterprise Storage 5 (src):    squid-3.5.21-26.29.1
HPE Helion Openstack 8 (src):    squid-3.5.21-26.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 5 Wolfgang Frisch 2020-07-22 11:39:19 UTC 
*** Bug 1174381 has been marked as a duplicate of this bug. ***
Comment 7 Swamp Workflow Management 2020-08-24 16:15:11 UTC 
SUSE-SU-2020:14460-1: An update that fixes 21 vulnerabilities is now available.

Category: security (important)
Bug References: 1140738,1141329,1141332,1156323,1156324,1156326,1156328,1156329,1162687,1162689,1162691,1167373,1169659,1170313,1170423,1173304,1173455
CVE References: CVE-2019-12519,CVE-2019-12520,CVE-2019-12521,CVE-2019-12523,CVE-2019-12524,CVE-2019-12525,CVE-2019-12526,CVE-2019-12528,CVE-2019-12529,CVE-2019-13345,CVE-2019-18676,CVE-2019-18677,CVE-2019-18678,CVE-2019-18679,CVE-2019-18860,CVE-2020-11945,CVE-2020-14059,CVE-2020-15049,CVE-2020-8449,CVE-2020-8450,CVE-2020-8517
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    squid3-3.1.23-8.16.37.12.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    squid3-3.1.23-8.16.37.12.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    squid3-3.1.23-8.16.37.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-09-02 13:19:42 UTC 
SUSE-SU-2020:2442-1: An update that fixes four vulnerabilities is now available.

Category: security (critical)
Bug References: 1173455,1175664,1175665,1175671
CVE References: CVE-2020-15049,CVE-2020-15810,CVE-2020-15811,CVE-2020-24606
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    squid-4.13-5.23.1
SUSE Linux Enterprise Server 15-LTSS (src):    squid-4.13-5.23.1
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    squid-4.13-5.23.1
SUSE Linux Enterprise Module for Server Applications 15-SP1 (src):    squid-4.13-5.23.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    squid-4.13-5.23.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    squid-4.13-5.23.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2020-09-02 13:22:08 UTC 
SUSE-SU-2020:2443-1: An update that fixes four vulnerabilities is now available.

Category: security (critical)
Bug References: 1173455,1175664,1175665,1175671
CVE References: CVE-2020-15049,CVE-2020-15810,CVE-2020-15811,CVE-2020-24606
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    squid-4.13-4.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-09-05 16:17:47 UTC 
openSUSE-SU-2020:1346-1: An update that fixes four vulnerabilities is now available.

Category: security (critical)
Bug References: 1173455,1175664,1175665,1175671
CVE References: CVE-2020-15049,CVE-2020-15810,CVE-2020-15811,CVE-2020-24606
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    squid-4.13-lp151.2.24.1
Comment 12 Swamp Workflow Management 2020-09-07 13:35:56 UTC 
openSUSE-SU-2020:1369-1: An update that fixes four vulnerabilities is now available.

Category: security (critical)
Bug References: 1173455,1175664,1175665,1175671
CVE References: CVE-2020-15049,CVE-2020-15810,CVE-2020-15811,CVE-2020-24606
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    squid-4.13-lp152.2.6.1
First Last Prev Next    This bug is not in your last search results.