[ADVISORY] SQUID-2016:8 Header smuggling issue in HTTP Request processing
Amos Jeffries <[email protected]> Mon, 9 May 2016 20:25:23 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <2d8dbaeb-6adc-2bae-4c4f-c3e4ec40c19b__45953.861779026$1462782760$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTY6OApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxNjo4 CkRhdGU6ICAgICAgICAgICAgICAgTWF5IDA2LCAyMDE2ClN1bW1hcnk6ICAgICAgICAgICAgSGVh ZGVyIHNtdWdnbGluZyBpc3N1ZQogICAgICAgICAgICAgICAgICAgIGluIEhUVFAgUmVxdWVzdCBw cm9jZXNzaW5nCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgMS54IC0+IDMuNS4xNwpGaXhlZCBp biB2ZXJzaW9uOiAgIFNxdWlkIDMuNS4xOApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlk LWNhY2hlLm9yZy9BZHZpc29yaWVzL1NRVUlELTIwMTZfOC50eHQKICAgIGh0dHA6Ly9jdmUubWl0 cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAxNi00NTU0Cl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoK UHJvYmxlbSBEZXNjcmlwdGlvbjoKCiBEdWUgdG8gaW5jb3JyZWN0IGlucHV0IHZhbGlkYXRpb24g U3F1aWQgaXMgdnVsbmVyYWJsZSB0byBhIGhlYWRlcgogc211Z2dsaW5nIGF0dGFjayBsZWFkaW5n IHRvIGNhY2hlIHBvaXNvbmluZyBhbmQgdG8gYnlwYXNzIG9mCiBzYW1lLW9yaWdpbiBzZWN1cml0 eSBwb2xpY3kgaW4gU3F1aWQgYW5kIHNvbWUgY2xpZW50IGJyb3dzZXJzLgoKX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpT ZXZlcml0eToKCiBUaGlzIHByb2JsZW0gYWxsb3dzIGEgY2xpZW50IHRvIHNtdWdnbGUgSG9zdCBo ZWFkZXIgdmFsdWUgcGFzdAogc2FtZS1vcmlnaW4gc2VjdXJpdHkgcHJvdGVjdGlvbnMgdG8gY2F1 c2UgU3F1aWQgb3BlcmF0aW5nIGFzCiBpbnRlcmNlcHRpb24gb3IgcmV2ZXJzZS1wcm94eSB0byBj b250YWN0IHRoZSB3cm9uZyBvcmlnaW4KIHNlcnZlci4gQWxzbyBwb2lzb25pbmcgYW55IGRvd25z dHJlYW0gY2FjaGUgd2hpY2ggc3RvcmVzIHRoZQogcmVzcG9uc2UuCgogSG93ZXZlciwgdGhlIGNh Y2hlIHBvaXNvbmluZyBpcyBvbmx5IHBvc3NpYmxlIGlmIHRoZSBjYWNoaW5nCiBhZ2VudCAoYnJv d3NlciBvciBleHBsaWNpdC9mb3J3YXJkIHByb3h5KSBpcyBub3QgZm9sbG93aW5nIFJGQwogNzIz MCBwcm9jZXNzaW5nIGd1aWRlbGluZXMgYW5kIGxldHMgdGhlIHNtdWdnbGVkIHZhbHVlIHRocm91 Z2guCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KClVwZGF0ZWQgUGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkg U3F1aWQgdmVyc2lvbiAzLjUuMTgKCiBJbiBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRo aXMgcHJvYmxlbSBmb3Igc3RhYmxlIHJlbGVhc2VzCiBjYW4gYmUgZm91bmQgaW4gb3VyIHBhdGNo IGFyY2hpdmVzOgoKU3F1aWQgMy4xOgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNp b25zL3YzLzMuMS9jaGFuZ2VzZXRzL1NRVUlELTIwMTZfOC5wYXRjaD4KClNxdWlkIDMuMjoKIDxo dHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92My8zLjIvY2hhbmdlc2V0cy9TUVVJ RC0yMDE2XzgucGF0Y2g+CgpTcXVpZCAzLjM6CiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcv VmVyc2lvbnMvdjMvMy4zL2NoYW5nZXNldHMvU1FVSUQtMjAxNl84LnBhdGNoPgoKU3F1aWQgMy40 OgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3YzLzMuNC9jaGFuZ2VzZXRz L1NRVUlELTIwMTZfOC5wYXRjaD4KClNxdWlkIDMuNToKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hl Lm9yZy9WZXJzaW9ucy92My8zLjUvY2hhbmdlc2V0cy9TUVVJRC0yMDE2XzgucGF0Y2g+CgogSWYg eW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVhc2Ug cmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmlsaXR5IGluZm9ybWF0aW9u IG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZl cnNpb24gaXMgdnVsbmVyYWJsZToKCiAgQWxsIDIueCB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVk aW5nIDIuNy5TVEFCTEU5IGFyZSB2dWxuZXJhYmxlLgoKICBBbGwgMy54IHZlcnNpb25zIHVwIHRv IGFuZCBpbmNsdWRpbmcgMy41LjE3IGFyZSB2dWxuZXJhYmxlLgoKICBBbGwgNC54IHZlcnNpb25z IGFyZSBub3QgdnVsbmVyYWJsZS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKV29ya2Fyb3VuZDoKCiBUaGVyZSBhcmUg bm8gd29ya2Fyb3VuZHMgZm9yIHRoaXMgcHJvYmxlbS4KCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ29udGFjdCBkZXRh aWxzIGZvciB0aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBz dXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2YgU3F1aWQ6IFlvdXIgZmlyc3Qg cG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKIHBhY2thZ2UgdmVuZG9yLgoK IElmIHlvdSBpbnN0YWxsIGFuZCBidWlsZCBTcXVpZCBmcm9tIHRoZSBvcmlnaW5hbCBTcXVpZCBz b3VyY2VzCiB0aGVuIHRoZSBzcXVpZC11c2Vyc0BzcXVpZC1jYWNoZS5vcmcgbWFpbGluZyBsaXN0 IGlzIHlvdXIKIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNjcmlwdGlvbiBkZXRhaWxz IHNlZQogaHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvU3VwcG9ydC9tYWlsaW5nLWxpc3RzLmh0 bWwuCgogRm9yIHJlcG9ydGluZyBvZiBub24tc2VjdXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IHJl bGVhc2UKIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFzZSBzaG91bGQgYmUgdXNlZAogaHR0cDov L2J1Z3Muc3F1aWQtY2FjaGUub3JnLy4KCiBGb3IgcmVwb3J0aW5nIG9mIHNlY3VyaXR5IHNlbnNp dGl2ZSBidWdzIHNlbmQgYW4gZW1haWwgdG8gdGhlCiBzcXVpZC1idWdzQHNxdWlkLWNhY2hlLm9y ZyBtYWlsaW5nIGxpc3QuIEl0IGlzIGEgY2xvc2VkIGxpc3QKICh0aG91Z2ggYW55b25lIGNhbiBw b3N0KSBhbmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVwb3J0cyBhcmUKIHRyZWF0ZWQgaW4gY29u ZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVzdGFibGlzaGVkLgoKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f CgpDcmVkaXRzOgoKIFRoZSB2dWxuZXJhYmlsaXR5IHdhcyByZXBvcnRlZCBieSBKaWFuanVuIENo ZW4gZnJvbSBUc2luZ2h1YQogVW5pdmVyc2l0eS4KCiBGaXhlZCBieSBBbW9zIEplZmZyaWVzIGZy b20gVHJlZWhvdXNlIE5ldHdvcmtzIEx0ZC4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUmV2aXNpb24gaGlzdG9yeToK CiAyMDE2LTA0LTI2IDA5OjI5OjEzIFVUQyBJbml0aWFsIFJlcG9ydAogMjAxNi0wNS0wMiAwMzoz OTozNSBVVEMgUGF0Y2hlcyBSZWxlYXNlZAogMjAxNi0wNS0wNiAxMzoxMjowMCBVVEMgUGFja2Fn ZXMgUmVsZWFzZWQKIDIwMTYtMDUtMDYgMTQ6NDY6NDEgVVRDIENWRSBBc3NpZ25tZW50CiAyMDE2 LTA1LTA4IDEyOjQ1OjU4IFVUQyBQYXRjaGVzIFVwZGF0ZWQKX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkVORApfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzcXVpZC1hbm5vdW5jZSBt YWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9s aXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1aWQtYW5ub3VuY2UK