[ADVISORY] SQUID-2016:8 Header smuggling issue in HTTP Request processing

Amos Jeffries <[email protected]> Mon, 9 May 2016 20:25:23 +1200
Newsgroups gmane.comp.web.squid.announce
Message-ID <2d8dbaeb-6adc-2bae-4c4f-c3e4ec40c19b__45953.861779026$1462782760$gmane$org@treenet.co.nz>
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5
IFNRVUlELTIwMTY6OApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxNjo4
CkRhdGU6ICAgICAgICAgICAgICAgTWF5IDA2LCAyMDE2ClN1bW1hcnk6ICAgICAgICAgICAgSGVh
ZGVyIHNtdWdnbGluZyBpc3N1ZQogICAgICAgICAgICAgICAgICAgIGluIEhUVFAgUmVxdWVzdCBw
cm9jZXNzaW5nCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgMS54IC0+IDMuNS4xNwpGaXhlZCBp
biB2ZXJzaW9uOiAgIFNxdWlkIDMuNS4xOApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlk
LWNhY2hlLm9yZy9BZHZpc29yaWVzL1NRVUlELTIwMTZfOC50eHQKICAgIGh0dHA6Ly9jdmUubWl0
cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAxNi00NTU0Cl9fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoK
UHJvYmxlbSBEZXNjcmlwdGlvbjoKCiBEdWUgdG8gaW5jb3JyZWN0IGlucHV0IHZhbGlkYXRpb24g
U3F1aWQgaXMgdnVsbmVyYWJsZSB0byBhIGhlYWRlcgogc211Z2dsaW5nIGF0dGFjayBsZWFkaW5n
IHRvIGNhY2hlIHBvaXNvbmluZyBhbmQgdG8gYnlwYXNzIG9mCiBzYW1lLW9yaWdpbiBzZWN1cml0
eSBwb2xpY3kgaW4gU3F1aWQgYW5kIHNvbWUgY2xpZW50IGJyb3dzZXJzLgoKX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpT
ZXZlcml0eToKCiBUaGlzIHByb2JsZW0gYWxsb3dzIGEgY2xpZW50IHRvIHNtdWdnbGUgSG9zdCBo
ZWFkZXIgdmFsdWUgcGFzdAogc2FtZS1vcmlnaW4gc2VjdXJpdHkgcHJvdGVjdGlvbnMgdG8gY2F1
c2UgU3F1aWQgb3BlcmF0aW5nIGFzCiBpbnRlcmNlcHRpb24gb3IgcmV2ZXJzZS1wcm94eSB0byBj
b250YWN0IHRoZSB3cm9uZyBvcmlnaW4KIHNlcnZlci4gQWxzbyBwb2lzb25pbmcgYW55IGRvd25z
dHJlYW0gY2FjaGUgd2hpY2ggc3RvcmVzIHRoZQogcmVzcG9uc2UuCgogSG93ZXZlciwgdGhlIGNh
Y2hlIHBvaXNvbmluZyBpcyBvbmx5IHBvc3NpYmxlIGlmIHRoZSBjYWNoaW5nCiBhZ2VudCAoYnJv
d3NlciBvciBleHBsaWNpdC9mb3J3YXJkIHByb3h5KSBpcyBub3QgZm9sbG93aW5nIFJGQwogNzIz
MCBwcm9jZXNzaW5nIGd1aWRlbGluZXMgYW5kIGxldHMgdGhlIHNtdWdnbGVkIHZhbHVlIHRocm91
Z2guCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX18KClVwZGF0ZWQgUGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkg
U3F1aWQgdmVyc2lvbiAzLjUuMTgKCiBJbiBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRo
aXMgcHJvYmxlbSBmb3Igc3RhYmxlIHJlbGVhc2VzCiBjYW4gYmUgZm91bmQgaW4gb3VyIHBhdGNo
IGFyY2hpdmVzOgoKU3F1aWQgMy4xOgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNp
b25zL3YzLzMuMS9jaGFuZ2VzZXRzL1NRVUlELTIwMTZfOC5wYXRjaD4KClNxdWlkIDMuMjoKIDxo
dHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92My8zLjIvY2hhbmdlc2V0cy9TUVVJ
RC0yMDE2XzgucGF0Y2g+CgpTcXVpZCAzLjM6CiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcv
VmVyc2lvbnMvdjMvMy4zL2NoYW5nZXNldHMvU1FVSUQtMjAxNl84LnBhdGNoPgoKU3F1aWQgMy40
OgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3YzLzMuNC9jaGFuZ2VzZXRz
L1NRVUlELTIwMTZfOC5wYXRjaD4KClNxdWlkIDMuNToKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hl
Lm9yZy9WZXJzaW9ucy92My8zLjUvY2hhbmdlc2V0cy9TUVVJRC0yMDE2XzgucGF0Y2g+CgogSWYg
eW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVhc2Ug
cmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmlsaXR5IGluZm9ybWF0aW9u
IG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZl
cnNpb24gaXMgdnVsbmVyYWJsZToKCiAgQWxsIDIueCB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVk
aW5nIDIuNy5TVEFCTEU5IGFyZSB2dWxuZXJhYmxlLgoKICBBbGwgMy54IHZlcnNpb25zIHVwIHRv
IGFuZCBpbmNsdWRpbmcgMy41LjE3IGFyZSB2dWxuZXJhYmxlLgoKICBBbGwgNC54IHZlcnNpb25z
IGFyZSBub3QgdnVsbmVyYWJsZS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKV29ya2Fyb3VuZDoKCiBUaGVyZSBhcmUg
bm8gd29ya2Fyb3VuZHMgZm9yIHRoaXMgcHJvYmxlbS4KCl9fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ29udGFjdCBkZXRh
aWxzIGZvciB0aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBz
dXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2YgU3F1aWQ6IFlvdXIgZmlyc3Qg
cG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKIHBhY2thZ2UgdmVuZG9yLgoK
IElmIHlvdSBpbnN0YWxsIGFuZCBidWlsZCBTcXVpZCBmcm9tIHRoZSBvcmlnaW5hbCBTcXVpZCBz
b3VyY2VzCiB0aGVuIHRoZSBzcXVpZC11c2Vyc0BzcXVpZC1jYWNoZS5vcmcgbWFpbGluZyBsaXN0
IGlzIHlvdXIKIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNjcmlwdGlvbiBkZXRhaWxz
IHNlZQogaHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvU3VwcG9ydC9tYWlsaW5nLWxpc3RzLmh0
bWwuCgogRm9yIHJlcG9ydGluZyBvZiBub24tc2VjdXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IHJl
bGVhc2UKIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFzZSBzaG91bGQgYmUgdXNlZAogaHR0cDov
L2J1Z3Muc3F1aWQtY2FjaGUub3JnLy4KCiBGb3IgcmVwb3J0aW5nIG9mIHNlY3VyaXR5IHNlbnNp
dGl2ZSBidWdzIHNlbmQgYW4gZW1haWwgdG8gdGhlCiBzcXVpZC1idWdzQHNxdWlkLWNhY2hlLm9y
ZyBtYWlsaW5nIGxpc3QuIEl0IGlzIGEgY2xvc2VkIGxpc3QKICh0aG91Z2ggYW55b25lIGNhbiBw
b3N0KSBhbmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVwb3J0cyBhcmUKIHRyZWF0ZWQgaW4gY29u
ZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVzdGFibGlzaGVkLgoKX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
CgpDcmVkaXRzOgoKIFRoZSB2dWxuZXJhYmlsaXR5IHdhcyByZXBvcnRlZCBieSBKaWFuanVuIENo
ZW4gZnJvbSBUc2luZ2h1YQogVW5pdmVyc2l0eS4KCiBGaXhlZCBieSBBbW9zIEplZmZyaWVzIGZy
b20gVHJlZWhvdXNlIE5ldHdvcmtzIEx0ZC4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUmV2aXNpb24gaGlzdG9yeToK
CiAyMDE2LTA0LTI2IDA5OjI5OjEzIFVUQyBJbml0aWFsIFJlcG9ydAogMjAxNi0wNS0wMiAwMzoz
OTozNSBVVEMgUGF0Y2hlcyBSZWxlYXNlZAogMjAxNi0wNS0wNiAxMzoxMjowMCBVVEMgUGFja2Fn
ZXMgUmVsZWFzZWQKIDIwMTYtMDUtMDYgMTQ6NDY6NDEgVVRDIENWRSBBc3NpZ25tZW50CiAyMDE2
LTA1LTA4IDEyOjQ1OjU4IFVUQyBQYXRjaGVzIFVwZGF0ZWQKX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkVORApfX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzcXVpZC1hbm5vdW5jZSBt
YWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9s
aXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1aWQtYW5ub3VuY2UK