[ADVISORY] SQUID-2016:11 - Information disclosure in HTTP Request processing
Amos Jeffries <[email protected]> Sun, 18 Dec 2016 05:05:09 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <b7ad193e-b769-432d-bf47-2dfc35c8c133__29075.9060568691$1481995386$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTY6MTEKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgIFNRVUlELTIwMTY6 MTEKRGF0ZTogICAgICAgICAgICAgICBEZWMgMTYsIDIwMTYKU3VtbWFyeTogICAgICAgICAgICBJ bmZvcm1hdGlvbiBkaXNjbG9zdXJlCiAgICAgICAgICAgICAgICAgICAgaW4gSFRUUCBSZXF1ZXN0 IHByb2Nlc3NpbmcuCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgMi42IC0+IDIuNy5TVEFCTEU5 CiAgICAgICAgICAgICAgICAgICAgU3F1aWQgMy4xIC0+IDMuNS4yMgogICAgICAgICAgICAgICAg ICAgIFNxdWlkIDQuMCAtPiA0LjAuMTYKRml4ZWQgaW4gdmVyc2lvbjogICBTcXVpZCA0LjAuMTcs IDMuNS4yMwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9BZHZpc29y aWVzL1NRVUlELTIwMTZfMTEudHh0Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlvbjoKCiBE dWUgdG8gaW5jb3JyZWN0IEhUVFAgY29uZGl0aW9uYWwgcmVxdWVzdCBoYW5kbGluZyBTcXVpZCBj YW4KIGRlbGl2ZXIgcmVzcG9uc2VzIGNvbnRhaW5pbmcgcHJpdmF0ZSBkYXRhIHRvIGNsaWVudHMg aXQgc2hvdWxkCiBub3QgaGF2ZSByZWFjaGVkLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZlcml0eToKCiBUaGlz IHByb2JsZW0gYWxsb3dzIGEgcmVtb3RlIGF0dGFja2VyIHRvIGRpc2NvdmVyIHByaXZhdGUgYW5k CiBzZW5zaXRpdmUgaW5mb3JtYXRpb24gYWJvdXQgYW5vdGhlciBjbGllbnRzIGJyb3dzaW5nIHNl c3Npb24uCiBQb3RlbnRpYWxseSBpbmNsdWRpbmcgY3JlZGVudGlhbHMgd2hpY2ggYWxsb3cgYWNj ZXNzIHRvIGZ1cnRoZXIKIHNlbnNpdGl2ZSByZXNvdXJjZXMuCgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClVwZGF0ZWQg UGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lvbiAzLjUuMjMgYW5k IDQuMC4xNy4KCiBJbiBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRoaXMgcHJvYmxlbSBj YW4gYmUgZm91bmQgaW4gb3VyCiBwYXRjaCBhcmNoaXZlczoKClNxdWlkIDMuMToKIDxodHRwOi8v d3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92My8zLjEvY2hhbmdlc2V0cy9TUVVJRC0yMDE2 XzExLnBhdGNoPgoKU3F1aWQgMy4yOgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNp b25zL3YzLzMuMi9jaGFuZ2VzZXRzL1NRVUlELTIwMTZfMTEucGF0Y2g+CgpTcXVpZCAzLjM6CiA8 aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjMvMy4zL2NoYW5nZXNldHMvU1FV SUQtMjAxNl8xMS5wYXRjaD4KClNxdWlkIDMuNDoKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9y Zy9WZXJzaW9ucy92My8zLjQvY2hhbmdlc2V0cy9TUVVJRC0yMDE2XzExLnBhdGNoPgoKU3F1aWQg My41OgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3YzLzMuNS9jaGFuZ2Vz ZXRzL1NRVUlELTIwMTZfMTEucGF0Y2g+CgpTcXVpZCA0LjA6CiA8aHR0cDovL3d3dy5zcXVpZC1j YWNoZS5vcmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9TUVVJRC0yMDE2XzExLnBhdGNoPgoKIElm IHlvdSBhcmUgdXNpbmcgYSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNl IHJlZmVyCiB0byB0aGUgcGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0eSBpbmZvcm1hdGlv biBvbiB1cGRhdGVkCiBwYWNrYWdlcy4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKRGV0ZXJtaW5pbmcgaWYgeW91ciB2 ZXJzaW9uIGlzIHZ1bG5lcmFibGU6CgogQWxsIFNxdWlkLTIueCB2ZXJzaW9ucyBhcmUgbm90IHZ1 bG5lcmFibGUuCgogQWxsIFNxdWlkLTMuMCBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlk LTMuMSB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nIDMuMS45IGFyZSBub3QKIHZ1bG5lcmFi bGUuCgogQWxsIFNxdWlkLTMuMSB2ZXJzaW9ucyAzLjEuMTAgYW5kIGxhdGVyIGFyZSB2dWxuZXJh YmxlLgoKIFNxdWlkLTMuMi4wLjEgYW5kIDMuMi4wLjIgYXJlIG5vdCB2dWxuZXJhYmxlLgoKIEFs bCBTcXVpZC0zLjIgdmVyc2lvbnMgMy4yLjAuMyBhbmQgbGF0ZXIgYXJlIHZ1bG5lcmFibGUuCgog QWxsIFNxdWlkLTMuMyB2ZXJzaW9ucyBhcmUgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtMy40IHZl cnNpb25zIGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjUgdmVyc2lvbnMgdXAgdG8gYW5k IGluY2x1ZGluZyBTcXVpZC0zLjUuMjIgYXJlCiB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC00LjAg dmVyc2lvbnMgdXAgdG8gYW5kIGluY2x1ZGluZyBTcXVpZC00LjAuMTYgYXJlCiB2dWxuZXJhYmxl LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCgpXb3JrYXJvdW5kOgoKIFRoZSBvbmx5IHdvcmthcm91bmQga25vd24gaXMg dG8gZGlzYWJsZSBjYWNoaW5nLCBpbmNsdWRpbmcKIG1lbW9yeSBjYWNoZS4gSW4gc3F1aWQuY29u ZiBzZXQ6CgogICBjYWNoZSBkZW55IGFsbAogICBjYWNoZV9tZW0gMAoKX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpDb250 YWN0IGRldGFpbHMgZm9yIHRoZSBTcXVpZCBwcm9qZWN0OgoKIEZvciBpbnN0YWxsYXRpb24gLyB1 cGdyYWRlIHN1cHBvcnQgb24gYmluYXJ5IHBhY2thZ2VkIHZlcnNpb25zCiBvZiBTcXVpZDogWW91 ciBmaXJzdCBwb2ludCBvZiBjb250YWN0IHNob3VsZCBiZSB5b3VyIGJpbmFyeQogcGFja2FnZSB2 ZW5kb3IuCgogSWYgeW91ciBpbnN0YWxsIGFuZCBidWlsZCBTcXVpZCBmcm9tIHRoZSBvcmlnaW5h bCBTcXVpZCBzb3VyY2VzCiB0aGVuIHRoZSBzcXVpZC11c2Vyc0BsaXN0cy5zcXVpZC1jYWNoZS5v cmcgbWFpbGluZyBsaXN0IGlzIHlvdXIKIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNj cmlwdGlvbiBkZXRhaWxzIHNlZQogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1N1cHBvcnQv bWFpbGluZy1saXN0cy5odG1sPi4KCiBGb3IgcmVwb3J0aW5nIG9mIG5vbi1zZWN1cml0eSBidWdz IGluIHRoZSBsYXRlc3QgU1RBQkxFIHJlbGVhc2UKIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFz ZSBzaG91bGQgYmUgdXNlZAogPGh0dHA6Ly9idWdzLnNxdWlkLWNhY2hlLm9yZy8+LgoKIEZvciBy ZXBvcnRpbmcgb2Ygc2VjdXJpdHkgc2Vuc2l0aXZlIGJ1Z3Mgc2VuZCBhbiBlbWFpbCB0byB0aGUK IHNxdWlkLWJ1Z3NAbGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdC4gSXQncyBhIGNs b3NlZAogbGlzdCAodGhvdWdoIGFueW9uZSBjYW4gcG9zdCkgYW5kIHNlY3VyaXR5IHJlbGF0ZWQg YnVnIHJlcG9ydHMKIGFyZSB0cmVhdGVkIGluIGNvbmZpZGVuY2UgdW50aWwgdGhlIGltcGFjdCBo YXMgYmVlbiBlc3RhYmxpc2hlZC4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ3JlZGl0czoKCiBUaGlzIGlzc3VlIHdh cyByZXBvcnRlZCBieSBTYXVsaXVzIExhcGluc2thcyBmcm9tIExpdGh1YW5pYW4KIFN0YXRlIFNv Y2lhbCBJbnN1cmFuY2UgRnVuZCBCb2FyZC4KCiBGaXhlZCBieSBHYXJyaSBEamF2YWR5YW4gZnJv bSBpUGx1cyBMTEMgKENvbW5ldCBJU1ApLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoK IDIwMTQtMTItMzAgMTI6NDQ6MzIgVVRDIEluaXRpYWwgUmVwb3J0CiAyMDE2LTEyLTE2IDE4OjM3 OjAwIFVUQyBQYWNrYWdlcyBSZWxlYXNlZApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRU5ECl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91bmNlIG1haWxpbmcgbGlz dApzcXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0cDovL2xpc3RzLnNxdWlk LWNhY2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=