[ADVISORY] SQUID-2018:3 Denial of Service issue in ESI Response processing.
Amos Jeffries <[email protected]> Thu, 19 Apr 2018 00:43:18 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <6e49b05e-dcef-f217-f0a8-b304d73cd780__36708.9350511835$1524055630$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTg6MwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxODoz CkRhdGU6ICAgICAgICAgICAgICAgQXByaWwgMTgsIDIwMTgKU3VtbWFyeTogICAgICAgICAgICBE ZW5pYWwgb2YgU2VydmljZSBpc3N1ZQogICAgICAgICAgICAgICAgICAgIGluIEVTSSBSZXNwb25z ZSBwcm9jZXNzaW5nLgpBZmZlY3RlZCB2ZXJzaW9uczogIFNxdWlkIDMuMS4xMi4yIC0+IDMuMS4y MwogICAgICAgICAgICAgICAgICAgIFNxdWlkIDMuMi4wLjggLT4gMy4yLjE0CiAgICAgICAgICAg ICAgICAgICAgU3F1aWQgMy4zIC0+IDQuMC4xMgpGaXhlZCBpbiB2ZXJzaW9uOiAgIFNxdWlkIDQu MC4xMwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9BZHZpc29yaWVz L1NRVUlELTIwMThfMy50eHQKICAgIGh0dHA6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFt ZS5jZ2k/bmFtZT1DVkUtMjAxOC0xMTcyCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlvbjoK CiBEdWUgdG8gaW5jb3JyZWN0IHBvaW50ZXIgaGFuZGxpbmcgU3F1aWQgaXMgdnVsbmVyYWJsZSB0 byBkZW5pYWwKIG9mIHNlcnZpY2UgYXR0YWNrIHdoZW4gcHJvY2Vzc2luZyBFU0kgcmVzcG9uc2Vz LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCgpTZXZlcml0eToKCiBUaGlzIHByb2JsZW0gYWxsb3dzIGEgcmVtb3RlIHNl cnZlciBkZWxpdmVyaW5nIEVTSSByZXNwb25zZXMKIHRvIHRyaWdnZXIgYSBkZW5pYWwgb2Ygc2Vy dmljZSBmb3IgYWxsIGNsaWVudHMgYWNjZXNzaW5nIHRoZQogU3F1aWQgc2VydmljZS4KCiBUaGlz IHByb2JsZW0gaXMgbGltaXRlZCB0byBTcXVpZCBvcGVyYXRpbmcgYXMgcmV2ZXJzZSBwcm94eS4K Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXwoKVXBkYXRlZCBQYWNrYWdlczoKCiBUaGlzIGJ1ZyBpcyBmaXhlZCBieSBTcXVp ZCB2ZXJzaW9uIDQuMC4xMy4KCiBJbiBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRoaXMg cHJvYmxlbSBmb3IgdGhlIHN0YWJsZQogcmVsZWFzZXMgY2FuIGJlIGZvdW5kIGluIG91ciBwYXRj aCBhcmNoaXZlczoKClNxdWlkIDMuNToKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJz aW9ucy92My8zLjUvY2hhbmdlc2V0cy9TUVVJRC0yMDE4XzMucGF0Y2g+CgogSWYgeW91IGFyZSB1 c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVhc2UgcmVmZXIKIHRv IHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmlsaXR5IGluZm9ybWF0aW9uIG9uIHVwZGF0 ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZlcnNpb24gaXMg dnVsbmVyYWJsZToKCiBBbGwgU3F1aWQtMi54IGFuZCBvbGRlciBhcmUgbm90IHZ1bG5lcmFibGUu CgogQWxsIFNxdWlkLTMuMCBhbmQgb2xkZXIgdmVyc2lvbiBhcmUgbm90IHZ1bG5lcmFibGUuCgog QWxsIFNxdWlkIGJ1aWx0IHdpdGggLS1kaXNhYmxlLWVzaSBhcmUgbm90IHZ1bG5lcmFibGUuCgog QWxsIFNxdWlkLTMueCB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nIDMuNC4xNCBidWlsdCB3 aXRoCiAtLWRpc2FibGUtc3NsIGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtMy54IHZl cnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcgMy40LjE0IGJ1aWx0IHdpdGhvdXQKIC0tZW5hYmxl LXNzbCBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMueCB2ZXJzaW9ucyB1cCB0byBh bmQgaW5jbHVkaW5nIDMuNS4yNyBidWlsdCB3aXRob3V0CiAtLWVuYWJsZS1lc2kgYXJlIG5vdCB2 dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjEuMTIuMiBhbmQgbGF0ZXIgdmVyc2lvbnMgdXAgdG8g YW5kIGluY2x1ZGluZwogU3F1aWQtMy4xLjIzIGJ1aWx0IHdpdGggLS1lbmFibGUtZXNpIGFuZC0t ZW5hYmxlLXNzbCwgYW5kIGJlaW5nCiB1c2VkIGZvciByZXZlcnNlLXByb3h5IGFyZSB2dWxuZXJh YmxlLgoKIEFsbCBTcXVpZC0zLjIuMC44IGFuZCBsYXRlciB2ZXJzaW9ucyB1cCB0byBhbmQgaW5j bHVkaW5nCiBTcXVpZC0zLjIuMTQgYnVpbHQgd2l0aCAtLWVuYWJsZS1lc2kgYW5kIC0tZW5hYmxl LXNzbCwgYW5kIGJlaW5nCiB1c2VkIGZvciByZXZlcnNlLXByb3h5IGFyZSB2dWxuZXJhYmxlLgoK IEFsbCBTcXVpZC0zLjMgYW5kIGxhdGVyIHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcKIFNx dWlkLTMuMy4xNCBidWlsdCB3aXRoIC0tZW5hYmxlLWVzaSBhbmQgLS1lbmFibGUtc3NsLCBhbmQg YmVpbmcKIHVzZWQgZm9yIHJldmVyc2UtcHJveHkgYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlk LTMuNCBhbmQgbGF0ZXIgdmVyc2lvbnMgdXAgdG8gYW5kIGluY2x1ZGluZwogU3F1aWQtMy40LjE0 IGJ1aWx0IHdpdGggLS1lbmFibGUtZXNpIGFuZCAtLWVuYWJsZS1zc2wsIGFuZCBiZWluZwogdXNl ZCBmb3IgcmV2ZXJzZS1wcm94eSBhcmUgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtMy41IHZlcnNp b25zIHVwIHRvIGFuZCBpbmNsdWRpbmcgMy41LjI3IGJ1aWx0IHdpdGhvdXQKIC0td2l0aC1vcGVu c3NsIGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtMy41IGFuZCBsYXRlciB2ZXJzaW9u cyB1cCB0byBhbmQgaW5jbHVkaW5nIDMuNS4yNyBidWlsdAogd2l0aCAtLWVuYWJsZS1lc2kgYW5k IC0td2l0aC1vcGVuc3NsLCBhbmQgYmVpbmcgdXNlZCBmb3IKIHJldmVyc2UtcHJveHkgYXJlIHZ1 bG5lcmFibGUuCgogQWxsIFNxdWlkLTQgdmVyc2lvbnMgdXAgdG8gYW5kIGluY2x1ZGluZyA0LjAu MTIgYnVpbHQgd2l0aG91dAogLS13aXRoLW9wZW5zc2wgYXJlIG5vdCB2dWxuZXJhYmxlLgoKIEFs bCBTcXVpZC00IHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcgNC4wLjEyIGJ1aWx0IHdpdGgK IC0td2l0aC1vcGVuc3NsIGFuZCBiZWluZyB1c2VkIGZvciByZXZlcnNlLXByb3h5IGFyZSB2dWxu ZXJhYmxlLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fCgpXb3JrYXJvdW5kczoKCkVpdGhlcjsKCiBCdWlsZCBTcXVpZCB3 aXRoIC0tZGlzYWJsZS1lc2kKCk9yLAoKIEJ1aWxkIFNxdWlkLTMuMSB0byAzLjQuMTQgb3IgbGF0 ZXIgd2l0aCAiLS1kaXNhYmxlLXNzbCIKCk9yLAoKIEJ1aWxkIFNxdWlkLTMuNSBvciBsYXRlciB3 aXRoICItLXdpdGhvdXQtb3BlbnNzbCIKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ29udGFjdCBkZXRhaWxzIGZvciB0 aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9u IGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2YgU3F1aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2Yg Y29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKIHBhY2thZ2UgdmVuZG9yLgoKIElmIHlvdXIg aW5zdGFsbCBhbmQgYnVpbGQgU3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwog dGhlbiB0aGUgc3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdCBp cyB5b3VyCiBwcmltYXJ5IHN1cHBvcnQgcG9pbnQuIEZvciBzdWJzY3JpcHRpb24gZGV0YWlscyBz ZWUKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9TdXBwb3J0L21haWxpbmctbGlzdHMuaHRt bD4uCgogRm9yIHJlcG9ydGluZyBvZiBub24tc2VjdXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNU QUJMRSByZWxlYXNlCiB0aGUgc3F1aWQgYnVnemlsbGEgZGF0YWJhc2Ugc2hvdWxkIGJlIHVzZWQK IDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4KCiBGb3IgcmVwb3J0aW5nIG9mIHNlY3Vy aXR5IHNlbnNpdGl2ZSBidWdzIHNlbmQgYW4gZW1haWwgdG8gdGhlCiBzcXVpZC1idWdzQGxpc3Rz LnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QuIEl0J3MgYSBjbG9zZWQKIGxpc3QgKHRob3Vn aCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0eSByZWxhdGVkIGJ1ZyByZXBvcnRzCiBhcmUg dHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNo ZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KCkNyZWRpdHM6CgogVGhpcyB2dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3Zl cmVkIGJ5IE1pY2hhZWwgTWFyc2hhbGwgb2YgVHJlbmQKIE1pY3JvIHdvcmtpbmcgd2l0aCBUcmVu ZCBNaWNybydzIFplcm8gRGF5IEluaXRpYXRpdmUuCgogRml4ZWQgYnkgQ2hyaXN0b3MgVHNhbnRp bGFzIG9uIGJlaGFsZiBvZiBNZWFzdXJlbWVudCBGYWN0b3J5LgoKX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpSZXZpc2lv biBoaXN0b3J5OgoKIDIwMTgtMDQtMTYgMTg6MjA6MTUgVVRDIEluaXRpYWwgUmVwb3J0CiAyMDE4 LTA0LTE2IDIyOjAyOjI1IFVUQyBQYXRjaGVzIFJlbGVhc2VkCiAyMDE4LTA0LTE4IDEyOjI4OjAw IFVUQyBBZHZpc29yeSBSZWxlYXNlZApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRU5ECl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91bmNlIG1haWxpbmcgbGlzdApz cXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0cDovL2xpc3RzLnNxdWlkLWNh Y2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=