Описание
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | released | 4.12-1ubuntu1 |
| eoan | ignored | end of life |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/focal | not-affected | 4.10-1ubuntu1.3 |
| focal | released | 4.10-1ubuntu1.3 |
| groovy | released | 4.12-1ubuntu1 |
| hirsute | released | 4.12-1ubuntu1 |
| precise/esm | DNE | |
| trusty | ignored | end of standard support |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 3.5.27-1ubuntu1.9 |
| devel | DNE | |
| eoan | DNE | |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/bionic | not-affected | 3.5.27-1ubuntu1.9 |
| esm-infra/focal | DNE | |
| esm-infra/xenial | not-affected | 3.5.12-1ubuntu7.15 |
| focal | DNE | |
| groovy | DNE | |
| hirsute | DNE |
Показывать по
EPSS
6.5 Medium
CVSS2
9.9 Critical
CVSS3
Связанные уязвимости
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.
An issue was discovered in http/ContentLengthInterpreter.cc in Squid b ...
Уязвимость компонента http/ContentLengthInterpreter.cc прокси-сервера Squid, позволяющая нарушителю отравлять содержимое кэша
EPSS
6.5 Medium
CVSS2
9.9 Critical
CVSS3