[ADVISORY] SQUID-2016:7 Cache poisoning issue in HTTP Request handling
Amos Jeffries <[email protected]> Mon, 9 May 2016 20:24:58 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <357b94df-6d53-0c77-b2a5-35ccc7a95394__38290.0490113117$1462782661$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTY6NwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxNjo3 CkRhdGU6ICAgICAgICAgICAgICAgTWF5IDA2LCAyMDE2ClN1bW1hcnk6ICAgICAgICAgICAgQ2Fj aGUgcG9pc29uaW5nIGlzc3VlCiAgICAgICAgICAgICAgICAgICAgaW4gSFRUUCBSZXF1ZXN0IGhh bmRsaW5nCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgMy4yLjAuMTEgLT4gMy41LjE3CiAgICAg ICAgICAgICAgICAgICAgU3F1aWQgNC54IC0+IDQuMC45CkZpeGVkIGluIHZlcnNpb246ICAgU3F1 aWQgMy41LjE4LCA0LjAuMTAKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCgogICAgaHR0cDovL3d3dy5zcXVpZC1jYWNoZS5v cmcvQWR2aXNvcmllcy9TUVVJRC0yMDE2XzcudHh0CiAgICBodHRwOi8vY3ZlLm1pdHJlLm9yZy9j Z2ktYmluL2N2ZW5hbWUuY2dpP25hbWU9Q1ZFLTIwMTYtNDU1MwpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClByb2JsZW0g RGVzY3JpcHRpb246CgogRHVlIHRvIGluY29ycmVjdCBkYXRhIHZhbGlkYXRpb24gb2YgaW50ZXJj ZXB0ZWQgSFRUUCBSZXF1ZXN0CiBtZXNzYWdlcyBTcXVpZCBpcyB2dWxuZXJhYmxlIHRvIGNsaWVu dHMgYnlwYXNzaW5nIHRoZSBwcm90ZWN0aW9uCiBhZ2FpbnN0IENWRS0yMDA5LTA4MDEgcmVsYXRl ZCBpc3N1ZXMuIFRoaXMgbGVhZHMgdG8gY2FjaGUKIHBvaXNvbmluZy4KCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKU2V2 ZXJpdHk6CgogVGhpcyBwcm9ibGVtIGlzIHNlcmlvdXMgYmVjYXVzZSBpdCBhbGxvd3MgYW55IGNs aWVudCwgaW5jbHVkaW5nCiBicm93c2VyIHNjcmlwdHMsIHRvIGJ5cGFzcyBsb2NhbCBzZWN1cml0 eSBhbmQgcG9pc29uIHRoZSBwcm94eQogY2FjaGUgYW5kIGFueSBkb3duc3RyZWFtIGNhY2hlcyB3 aXRoIGNvbnRlbnQgZnJvbSBhbiBhcmJpdHJhcnkKIHNvdXJjZS4KCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKVXBkYXRl ZCBQYWNrYWdlczoKCiBUaGlzIGJ1ZyBpcyBmaXhlZCBieSBTcXVpZCB2ZXJzaW9uIDMuNS4xOCBh bmQgNC4wLjEwLgoKIEluIGFkZGl0aW9uLCBhIHBhdGNoIGFkZHJlc3NpbmcgdGhpcyBwcm9ibGVt IGZvciB0aGUgc3RhYmxlCiByZWxlYXNlIGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2 ZXM6CgpTcXVpZCAzLjU6CiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjMv My41L2NoYW5nZXNldHMvc3F1aWQtMy41LTE0MDM5LnBhdGNoPgoKIElmIHlvdSBhcmUgdXNpbmcg YSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNlIHJlZmVyCiB0byB0aGUg cGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0eSBpbmZvcm1hdGlvbiBvbiB1cGRhdGVkCiBw YWNrYWdlcy4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXwoKRGV0ZXJtaW5pbmcgaWYgeW91ciB2ZXJzaW9uIGlzIHZ1bG5l cmFibGU6CgpVc2UgdGhlIGNvbW1hbmQgJ3NxdWlkIC12JyB0byB2aWV3IHZlcnNpb24gYW5kIGJ1 aWxkIGRldGFpbHMgb2YKeW91ciBwcm94eTsKCiBBbGwgU3F1aWQgMi54IGFyZSBub3QgdnVsbmVy YWJsZS4KCiBBbGwgU3F1aWQtMy54IHVwIHRvIGFuZCBpbmNsdWRpbmcgMy4yLjAuMTAgYXJlIG5v dCB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjIuMC4xMSBhbmQgbGF0ZXIgdmVyc2lvbnMgdXAg dG8gYW5kIGluY2x1ZGluZyAzLjUuMTcKIGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC00Lngg dXAgdG8gYW5kIGluY2x1ZGluZyA0LjAuOSBhcmUgdnVsbmVyYWJsZS4KCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKV29y a2Fyb3VuZDoKCiBBZGQgdG8gc3F1aWQuY29uZjoKICAgY2xpZW50X2RzdF9wYXNzdGhydSBvZmYK CkFuZCwKCiBSZW1vdmUgYW55IHVzZSBvZiAiaG9zdF92ZXJpZnlfc3RyaWN0IiBkaXJlY3RpdmUu CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KCkNvbnRhY3QgZGV0YWlscyBmb3IgdGhlIFNxdWlkIHByb2plY3Q6CgogRm9y IGluc3RhbGxhdGlvbiAvIHVwZ3JhZGUgc3VwcG9ydCBvbiBiaW5hcnkgcGFja2FnZWQgdmVyc2lv bnMKIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9mIGNvbnRhY3Qgc2hvdWxkIGJlIHlvdXIg YmluYXJ5CiBwYWNrYWdlIHZlbmRvci4KCiBJZiB5b3UgaW5zdGFsbCBhbmQgYnVpbGQgU3F1aWQg ZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogdGhlbiB0aGUgc3F1aWQtdXNlcnNAc3F1 aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdCBpcyB5b3VyCiBwcmltYXJ5IHN1cHBvcnQgcG9pbnQu IEZvciBzdWJzY3JpcHRpb24gZGV0YWlscyBzZWUKIGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3Jn L1N1cHBvcnQvbWFpbGluZy1saXN0cy5odG1sLgoKIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3Vy aXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCByZWxlYXNlCiB0aGUgc3F1aWQgYnVnemlsbGEgZGF0YWJh c2Ugc2hvdWxkIGJlIHVzZWQKIGh0dHA6Ly9idWdzLnNxdWlkLWNhY2hlLm9yZy8uCgogRm9yIHJl cG9ydGluZyBvZiBzZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQog c3F1aWQtYnVnc0BzcXVpZC1jYWNoZS5vcmcgbWFpbGluZyBsaXN0LiBJdCBpcyBhIGNsb3NlZCBs aXN0CiAodGhvdWdoIGFueW9uZSBjYW4gcG9zdCkgYW5kIHNlY3VyaXR5IHJlbGF0ZWQgYnVnIHJl cG9ydHMgYXJlCiB0cmVhdGVkIGluIGNvbmZpZGVuY2UgdW50aWwgdGhlIGltcGFjdCBoYXMgYmVl biBlc3RhYmxpc2hlZC4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXwoKQ3JlZGl0czoKCiBUaGUgdnVsbmVyYWJpbGl0eSB3 YXMgcmVwb3J0ZWQgYnkgSmlhbmp1biBDaGVuIGZyb20gVHNpbmdodWEKIFVuaXZlcnNpdHkuCgog Rml4ZWQgYnkgQW1vcyBKZWZmcmllcyBmcm9tIFRyZWVob3VzZSBOZXR3b3JrcyBMdGQuCgpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18KClJldmlzaW9uIGhpc3Rvcnk6CgogMjAxNi0wNC0xNSAxMDo1NDozOSBVVEMgSW5pdGlh bCBSZXBvcnQKIDIwMTYtMDUtMDIgMTA6NTE6MTggVVRDIFBhdGNoIFJlbGVhc2VkCiAyMDE2LTA1 LTA2IDEzOjEyOjAwIFVUQyBQYWNrYWdlcyBSZWxlYXNlZAogMjAxNi0wNS0wNiAxNDo0Njo0MSBV VEMgQ1ZFIEFzc2lnbm1lbnQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQt YW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNoZS5v cmcvbGlzdGluZm8vc3F1aWQtYW5ub3VuY2UK