CVE-2019-18677

Опубликовано: 26 нояб. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 5.8

EPSS Низкий

Описание

An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.

Ссылки

http://www.squid-cache.org/Advisories/SQUID-2019_9.txt
Third Party Advisory
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-e5f1813a674848dde570f7920873e1071f96e0b4.patch
Release Notes
http://www.squid-cache.org/Versions/v4/changesets/squid-4-36492033ea4097821a4f7ff3ddcb971fbd1e8ba0.patch
Release Notes
https://bugzilla.suse.com/show_bug.cgi?id=1156328
Issue Tracking
Third Party Advisory
https://github.com/squid-cache/squid/pull/427
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
https://usn.ubuntu.com/4213-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4682
http://www.squid-cache.org/Advisories/SQUID-2019_9.txt
Third Party Advisory
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-e5f1813a674848dde570f7920873e1071f96e0b4.patch
Release Notes
http://www.squid-cache.org/Versions/v4/changesets/squid-4-36492033ea4097821a4f7ff3ddcb971fbd1e8ba0.patch
Release Notes
https://bugzilla.suse.com/show_bug.cgi?id=1156328
Issue Tracking
Third Party Advisory
https://github.com/squid-cache/squid/pull/427
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Версия от 2.0 (включая) до 2.7 (включая)

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Версия от 3.0 (включая) до 3.5.28 (включая)

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Версия от 4.0 (включая) до 4.8 (включая)

cpe:2.3:a:squid-cache:squid:2.7:stable2:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:2.7:stable5:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:2.7:stable6:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:2.7:stable7:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:2.7:stable8:*:*:*:*:*:*

cpe:2.3:a:squid-cache:squid:2.7:stable9:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04678

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2019-18677

CVSS3: 6.1

ubuntu

больше 5 лет назад

CVE-2019-18677

CVSS3: 7.4

redhat

больше 5 лет назад

CVE-2019-18677

CVSS3: 6.1

debian

больше 5 лет назад

An issue was discovered in Squid 3.x and 4.x through 4.8 when the appe ...

GHSA-mm65-p7g9-c5hr

CVSS3: 6.1

github

около 3 лет назад

BDU:2020-01858

CVSS3: 6.1

fstec

больше 5 лет назад

Уязвимость параметра append_domain прокси-сервера Squid, связанная с подделкой межсайтовых запросов, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность

EPSS

Процентиль: 89%

0.04678

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-352