[ADVISORY] SQUID-2018:2 Denial of Service issue in HTTP Message processing
Amos Jeffries <[email protected]> Sun, 21 Jan 2018 20:52:24 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <4e307c39-d1c1-eaca-2ce4-96a32892ccd5__15703.9074147635$1516610026$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgIFNxdWlkIFByb3h5IENhY2hlIFNlY3VyaXR5IFVwZGF0ZSBBZHZpc29y eSBTUVVJRC0yMDE4OjIKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgIFNRVUlELTIwMTg6 MgpEYXRlOiAgICAgICAgICAgICAgIEphbiAxOSwgMjAxOApTdW1tYXJ5OiAgICAgICAgICAgIERl bmlhbCBvZiBTZXJ2aWNlIGlzc3VlCiAgICAgICAgICAgICAgICAgICAgIGluIEhUVFAgTWVzc2Fn ZSBwcm9jZXNzaW5nLgpBZmZlY3RlZCB2ZXJzaW9uczogIFNxdWlkIDMueCAtPiAzLjUuMjcKICAg ICAgICAgICAgICAgICAgICAgU3F1aWQgNC54IC0+IDQuMC4yMgpGaXhlZCBpbiB2ZXJzaW9uOiAg IFNxdWlkIDQuMC4yMwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCiAgICAgaHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcv QWR2aXNvcmllcy9TUVVJRC0yMDE4XzIudHh0Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlv bjoKCiAgRHVlIHRvIGluY29ycmVjdCBwb2ludGVyIGhhbmRsaW5nIFNxdWlkIGlzIHZ1bG5lcmFi bGUgdG8gZGVuaWFsCiAgb2Ygc2VydmljZSBhdHRhY2sgd2hlbiBwcm9jZXNzaW5nIEVTSSByZXNw b25zZXMgb3IgZG93bmxvYWRpbmcKICBpbnRlcm1lZGlhdGUgQ0EgY2VydGlmaWNhdGVzLgoKX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fCgpTZXZlcml0eToKCiAgVGhpcyBwcm9ibGVtIGFsbG93cyBhIHJlbW90ZSBjbGllbnQg ZGVsaXZlcmluZyBjZXJ0YWluIEhUVFAKICByZXF1ZXN0cyBpbiBjb25qdW5jdGlvbiB3aXRoIGNl cnRhaW4gdHJ1c3RlZCBzZXJ2ZXIgcmVzcG9uc2VzIHRvCiAgdHJpZ2dlciBhIGRlbmlhbCBvZiBz ZXJ2aWNlIGZvciBhbGwgY2xpZW50cyBhY2Nlc3NpbmcgdGhlIFNxdWlkCiAgc2VydmljZS4KCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwoKVXBkYXRlZCBQYWNrYWdlczoKCiAgVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQg dmVyc2lvbiA0LjAuMjMuCgogIEluIGFkZGl0aW9uLCBwYXRjaGVzIGFkZHJlc3NpbmcgdGhpcyBw cm9ibGVtIGZvciB0aGUgc3RhYmxlCiAgcmVsZWFzZXMgY2FuIGJlIGZvdW5kIGluIG91ciBwYXRj aCBhcmNoaXZlczoKClNxdWlkIDMuNToKICA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVy c2lvbnMvdjMvMy41L2NoYW5nZXNldHMvU1FVSUQtMjAxOF8yLnBhdGNoPgoKU3F1aWQgNDoKICA8 aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9TUVVJRC0y MDE4XzIucGF0Y2g+CgogIElmIHlvdSBhcmUgdXNpbmcgYSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9m IFNxdWlkIHRoZW4gcGxlYXNlIHJlZmVyCiAgdG8gdGhlIHBhY2thZ2UgdmVuZG9yIGZvciBhdmFp bGFiaWxpdHkgaW5mb3JtYXRpb24gb24gdXBkYXRlZAogIHBhY2thZ2VzLgoKX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpE ZXRlcm1pbmluZyBpZiB5b3VyIHZlcnNpb24gaXMgdnVsbmVyYWJsZToKCiAgQWxsIFNxdWlkIGNv bmZpZ3VyZWQgd2l0aCAibG9nX3VzZXNfaW5kaXJlY3RfY2xpZW50IG9mZiIgYXJlIG5vdAogIHZ1 bG5lcmFibGUuCgogIEFsbCBTcXVpZC0zLjAgdmVyc2lvbnMgYnVpbHQgd2l0aCAtLWVuYWJsZS1l c2kgYW5kIGJlaW5nIHVzZWQgZm9yCiAgcmV2ZXJzZS1wcm94eSB3aXRoIHNxdWlkLmNvbmYgY29u dGFpbmluZwogICJsb2dfdXNlc19pbmRpcmVjdF9jbGllbnQgb24iIGFyZSB2dWxuZXJhYmxlLgoK ICBBbGwgU3F1aWQtMy4xIGFuZCBsYXRlciB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nCiAg U3F1aWQtMy41LjI3IGJlaW5nIHVzZWQgZm9yIHJldmVyc2UtcHJveHkgd2l0aCBzcXVpZC5jb25m CiAgY29udGFpbmluZyAibG9nX3VzZXNfaW5kaXJlY3RfY2xpZW50IG9uIiBhcmUgdnVsbmVyYWJs ZS4KCiAgQWxsIFNxdWlkLTQgdXAgdG8gYW5kIGluY2x1ZGluZyBTcXVpZC00LjAuMjIgYmVpbmcg dXNlZCBmb3IKICByZXZlcnNlLXByb3h5IHdpdGggc3F1aWQuY29uZiBjb250YWluaW5nCiAgImxv Z191c2VzX2luZGlyZWN0X2NsaWVudCBvbiIgYXJlIHZ1bG5lcmFibGUuCgogIEFsbCB1bnBhdGNo ZWQgU3F1aWQtNCB1cCB0byBhbmQgaW5jbHVkaW5nIFNxdWlkLTQuMC4yMiBiZWluZwogIHVzZWQg Zm9yIFRMUy9IVFRQUyBpbnRlcmNlcHQgcHJveHkgd2l0aCBzcXVpZC5jb25mIGNvbnRhaW5pbmcK ICAibG9nX3VzZXNfaW5kaXJlY3RfY2xpZW50IG9uIiBhcmUgdnVsbmVyYWJsZS4KCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwoKV29ya2Fyb3VuZHM6CgogIENvbmZpZ3VyZSAibG9nX3VzZXNfaW5kaXJlY3RfY2xpZW50IG9m ZiIgaW4gc3F1aWQuY29uZgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCgpDb250YWN0IGRldGFpbHMgZm9yIHRoZSBTcXVp ZCBwcm9qZWN0OgoKICBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFy eSBwYWNrYWdlZCB2ZXJzaW9ucwogIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9mIGNvbnRh Y3Qgc2hvdWxkIGJlIHlvdXIgYmluYXJ5CiAgcGFja2FnZSB2ZW5kb3IuCgogIElmIHlvdXIgaW5z dGFsbCBhbmQgYnVpbGQgU3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogIHRo ZW4gdGhlIHNxdWlkLXVzZXJzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QgaXMg eW91cgogIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNjcmlwdGlvbiBkZXRhaWxzIHNl ZQogIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9TdXBwb3J0L21haWxpbmctbGlzdHMuaHRt bD4uCgogIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBT VEFCTEUgcmVsZWFzZQogIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFzZSBzaG91bGQgYmUgdXNl ZAogIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4KCiAgRm9yIHJlcG9ydGluZyBvZiBz ZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogIHNxdWlkLWJ1Z3NA bGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdC4gSXQncyBhIGNsb3NlZAogIGxpc3Qg KHRob3VnaCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0eSByZWxhdGVkIGJ1ZyByZXBvcnRz CiAgYXJlIHRyZWF0ZWQgaW4gY29uZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVz dGFibGlzaGVkLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fCgpDcmVkaXRzOgoKICBUaGUgaW5pdGlhbCBpc3N1ZSB3YXMg cmVwb3J0ZWQgYnkgTG91aXMgRGlvbi1NYXJjaWwgb24gYmVoYWxmIG9mCiAgR29TZWN1cmUuCgog IEZpeGVkIGJ5IEFtb3MgSmVmZnJpZXMgZnJvbSBUcmVlaG91c2UgTmV0d29ya3MgTHRkLgoKX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKICAyMDE3LTEyLTEzIDIwOjA5OjMwIFVUQyBJbml0 aWFsIFJlcG9ydAogIDIwMTgtMDEtMTggMjM6MTA6MDAgVVRDIFBhdGNoZXMgUmVsZWFzZWQKICAy MDE4LTAxLTIxIDA3OjQ1OjAwIFVUQyBBZHZpc29yeSBhbmQgZml4ZWQgcGFja2FnZXMgcmVsZWFz ZWQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMu c3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1 aWQtYW5ub3VuY2UK