[ADVISORY] SQUID-2018:4 Cross-Site Scripting issue in TLS error processing
Amos Jeffries <[email protected]> Mon, 29 Oct 2018 05:09:09 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <cba3e2f4-bbc8-e639-3775-06b8277afe66__32246.7579193928$1540744734$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTg6NApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxODo0 CkRhdGU6ICAgICAgICAgICAgICAgT2N0b2JlciAyOCwgMjAxOApTdW1tYXJ5OiAgICAgICAgICAg IENyb3NzLVNpdGUgU2NyaXB0aW5nIGlzc3VlCiAgICAgICAgICAgICAgICAgICAgaW4gVExTIGVy cm9yIHByb2Nlc3NpbmcuCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgMy4xLjEyLjEgLT4gMy4x LjIzCiAgICAgICAgICAgICAgICAgICAgU3F1aWQgMy4yLjAuNCAtPiAzLjUuMjgKICAgICAgICAg ICAgICAgICAgICBTcXVpZCA0LjAgLT4gNC4zCkZpeGVkIGluIHZlcnNpb246ICAgU3F1aWQgNC40 Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXwoKICAgIGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL0Fkdmlzb3JpZXMvU1FV SUQtMjAxOF80LnR4dApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KClByb2JsZW0gRGVzY3JpcHRpb246CgogRHVlIHRvIGlu Y29ycmVjdCBpbnB1dCBoYW5kbGluZywgU3F1aWQgaXMgdnVsbmVyYWJsZSB0byBhCiBDcm9zcy1T aXRlIFNjcmlwdGluZyB2dWxuZXJhYmlsaXR5IHdoZW4gZ2VuZXJhdGluZyBIVFRQUyByZXNwb25z ZQogbWVzc2FnZXMgYWJvdXQgVExTIGVycm9ycy4KCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKU2V2ZXJpdHk6CgogVGhp cyBwcm9ibGVtIGFsbG93cyBhIG1hbGljaW91cyBIVFRQUyBzZXJ2ZXIgdG8gdHJpZ2dlciBlcnJv cgogcGFnZSBkZWxpdmVyeSB0byBhIGNsaWVudCBhbmQgYWxzbyBpbmplY3QgYXJiaXRyYXJ5IEhU TUwgY29kZQogaW50byB0aGUgcmVzdWx0aW5nIGVycm9yIHJlc3BvbnNlLgoKIFRoaXMgcHJvYmxl bSBpcyBsaW1pdGVkIHRvIFNxdWlkIGJ1aWx0IHdpdGggVExTIC8gU1NMIHN1cHBvcnQuCgpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18KClVwZGF0ZWQgUGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVy c2lvbiA0LjQuCgogSW4gYWRkaXRpb24sIHBhdGNoZXMgYWRkcmVzc2luZyB0aGlzIHByb2JsZW0g Zm9yIHRoZSBzdGFibGUKIHJlbGVhc2VzIGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2 ZXM6CgpTcXVpZCAzLjU6CiBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92My8z LjUvY2hhbmdlc2V0cy9zcXVpZC0zLjUtZjE2NTdhOWRlY2M4MjBmNzQ4ZmEzYWZmNjgxNjhkMzE0 NTI1ODAzMS5wYXRjaAoKU3F1aWQgNDoKIGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNp b25zL3Y0L2NoYW5nZXNldHMvc3F1aWQtNC04MjgyNDViOTAyMDY2MDIwMTRjZTA1N2MzZGIzOWZi ODBmY2M0YjA4LnBhdGNoCgogSWYgeW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24g b2YgU3F1aWQgdGhlbiBwbGVhc2UgcmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZh aWxhYmlsaXR5IGluZm9ybWF0aW9uIG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpE ZXRlcm1pbmluZyBpZiB5b3VyIHZlcnNpb24gaXMgdnVsbmVyYWJsZToKCiBBbGwgU3F1aWQtMi54 IGFuZCBvbGRlciBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMuMCBhbmQgb2xkZXIg dmVyc2lvbiBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMueCB2ZXJzaW9ucyB1cCB0 byBhbmQgaW5jbHVkaW5nIDMuNC4xNCBidWlsdCB3aXRoCiAtLWRpc2FibGUtc3NsIGFyZSBub3Qg dnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtMy54IHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcg My40LjE0IGJ1aWx0IHdpdGhvdXQKIC0tZW5hYmxlLXNzbCBhcmUgbm90IHZ1bG5lcmFibGUuCgog QWxsIFNxdWlkLTMuMS4xMi4xIGFuZCBsYXRlciB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVkaW5n CiBTcXVpZC0zLjEuMjMgYnVpbHQgd2l0aCAtLWVuYWJsZS1zc2wgYXJlIHZ1bG5lcmFibGUuCgog QWxsIFNxdWlkLTMuMi4wLjQgYW5kIGxhdGVyIHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcK IFNxdWlkLTMuMi4xNCBidWlsdCB3aXRoIC0tZW5hYmxlLXNzbCBhcmUgdnVsbmVyYWJsZS4KCiBB bGwgU3F1aWQtMy4zIGFuZCBsYXRlciB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nCiBTcXVp ZC0zLjMuMTQgYnVpbHQgd2l0aCAtLWVuYWJsZS1zc2wgYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNx dWlkLTMuNCBhbmQgbGF0ZXIgdmVyc2lvbnMgdXAgdG8gYW5kIGluY2x1ZGluZwogU3F1aWQtMy40 LjE0IGJ1aWx0IHdpdGggLS1lbmFibGUtc3NsIGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0z LjUgdmVyc2lvbnMgdXAgdG8gYW5kIGluY2x1ZGluZyAzLjUuMjggYnVpbHQgd2l0aG91dAogLS13 aXRoLW9wZW5zc2wgYXJlIG5vdCB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjUgYW5kIGxhdGVy IHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcgMy41LjI4IGJ1aWx0CiB3aXRoIC0td2l0aC1v cGVuc3NsIGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC00IHZlcnNpb25zIGJ1aWx0IHdpdGhv dXQgLS13aXRoLW9wZW5zc2wgYXJlIG5vdAogdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtNCB2ZXJz aW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nIDQuMyBidWlsdCB3aXRoCiAtLXdpdGgtb3BlbnNzbCBh cmUgdnVsbmVyYWJsZS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXwoKV29ya2Fyb3VuZHM6CgpFaXRoZXI7CgogUmVtb3Zl ICVEIGVycm9yIHBhZ2UgbWFjcm8gZnJvbSBFUlJfU0VDVVJFX0NPTk5FQ1RfRkFJTCBhbmQgYW55 CiBjdXN0b20gZXJyb3IgcGFnZXMuCgpPciwKCiBCdWlsZCBTcXVpZC0zLjEgdG8gMy40LjE0IHdp dGhvdXQgIi0tZW5hYmxlLXNzbCIKCk9yLAoKIEJ1aWxkIFNxdWlkLTMuNSBvciBsYXRlciB3aXRo b3V0ICItLXdpdGgtb3BlbnNzbCIKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ29udGFjdCBkZXRhaWxzIGZvciB0aGUg U3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJp bmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2YgU3F1aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2YgY29u dGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKIHBhY2thZ2UgdmVuZG9yLgoKIElmIHlvdXIgaW5z dGFsbCBhbmQgYnVpbGQgU3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogdGhl biB0aGUgc3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdCBpcyB5 b3VyCiBwcmltYXJ5IHN1cHBvcnQgcG9pbnQuIEZvciBzdWJzY3JpcHRpb24gZGV0YWlscyBzZWUK IDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9TdXBwb3J0L21haWxpbmctbGlzdHMuaHRtbD4u CgogRm9yIHJlcG9ydGluZyBvZiBub24tc2VjdXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNUQUJM RSByZWxlYXNlCiB0aGUgc3F1aWQgYnVnemlsbGEgZGF0YWJhc2Ugc2hvdWxkIGJlIHVzZWQKIDxo dHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4KCiBGb3IgcmVwb3J0aW5nIG9mIHNlY3VyaXR5 IHNlbnNpdGl2ZSBidWdzIHNlbmQgYW4gZW1haWwgdG8gdGhlCiBzcXVpZC1idWdzQGxpc3RzLnNx dWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QuIEl0J3MgYSBjbG9zZWQKIGxpc3QgKHRob3VnaCBh bnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0eSByZWxhdGVkIGJ1ZyByZXBvcnRzCiBhcmUgdHJl YXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQu CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KCkNyZWRpdHM6CgogVGhpcyB2dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVk IGJ5IE5pa29sYXMgTG9obWFubiBvZiBlQmxvY2tlcgogR21iSC4KCiBGaXhlZCBieSBDaHJpc3Rv cyBUc2FudGlsYXMgb24gYmVoYWxmIG9mIE1lYXN1cmVtZW50IEZhY3RvcnkuCgpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K ClJldmlzaW9uIGhpc3Rvcnk6CgogMjAxOC0xMC0xNSAxMDo1OToxNiBVVEMgSW5pdGlhbCBSZXBv cnQKIDIwMTgtMTAtMTcgMTU6MTM6NDEgVVRDIFBhdGNoZXMgUmVsZWFzZWQKIDIwMTgtMTAtMjcg MjE6MTk6MDAgVVRDIFBhY2thZ2VzIFJlbGVhc2VkCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpFTkQKX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc3F1aWQtYW5ub3VuY2UgbWFpbGlu ZyBsaXN0CnNxdWlkLWFubm91bmNlQGxpc3RzLnNxdWlkLWNhY2hlLm9yZwpodHRwOi8vbGlzdHMu c3F1aWQtY2FjaGUub3JnL2xpc3RpbmZvL3NxdWlkLWFubm91bmNlCg==