[ADVISORY] SQUID-2019:2 Denial of Service in HTTP Basic Authentication processing
Amos Jeffries <[email protected]> Sun, 14 Jul 2019 01:32:10 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <5785a67e-062a-3394-dbf4-32c973bec71a__24355.5871116527$1563024994$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6MgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxOToy CkRhdGU6ICAgICAgICAgICAgICAgSnVseSAxMiwgMjAxOQpTdW1tYXJ5OiAgICAgICAgICAgIERl bmlhbCBvZiBTZXJ2aWNlIGlzc3VlCiAgICAgICAgICAgICAgICAgICAgaW4gSFRUUCBCYXNpYyBB dXRoZW50aWNhdGlvbiBwcm9jZXNzaW5nLgpBZmZlY3RlZCB2ZXJzaW9uczogIFNxdWlkIDIueCAt PiAyLjcuU1RBQkxFOQogICAgICAgICAgICAgICAgICAgIFNxdWlkIDMueCAtPiAzLjUuMjgKICAg ICAgICAgICAgICAgICAgICBTcXVpZCA0LnggLT4gNC43CkZpeGVkIGluIHZlcnNpb246ICAgU3F1 aWQgNC44Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwoKICAgIGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL0Fkdmlzb3Jp ZXMvU1FVSUQtMjAxOV8yLnR4dAogICAgaHR0cDovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVu YW1lLmNnaT9uYW1lPUNWRS0yMDE5LTEyNTI5Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlv bjoKCiBEdWUgdG8gaW5jb3JyZWN0IGJ1ZmZlciBtYW5hZ2VtZW50IFNxdWlkIGlzIHZ1bG5lcmFi bGUgdG8gYQogZGVuaWFsIG9mIHNlcnZpY2UgYXR0YWNrIHdoZW4gcHJvY2Vzc2luZyBIVFRQIEJh c2ljCiBBdXRoZW50aWNhdGlvbiBjcmVkZW50aWFscy4KCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKU2V2ZXJpdHk6Cgog RHVlIHRvIGluY29ycmVjdCBzdHJpbmcgdGVybWluYXRpb24gdGhlIEJhc2ljIGF1dGhlbnRpY2F0 aW9uCiBjcmVkZW50aWFscyBkZWNvZGVyIG1heSBhY2Nlc3MgbWVtb3J5IG91dHNpZGUgdGhlIGRl Y29kZSBidWZmZXIuCgogT24gc3lzdGVtcyB3aXRoIG1lbW9yeSBhY2Nlc3MgcHJvdGVjdGlvbnMg dGhpcyBjYW4gcmVzdWx0IGluCiB0aGUgU3F1aWQgcHJvY2VzcyBiZWluZyB0ZXJtaW5hdGVkIHVu ZXhwZWN0ZWRseS4gUmVzdWx0aW5nIGluIGEKIGRlbmlhbCBvZiBzZXJ2aWNlIGZvciBhbGwgY2xp ZW50cyB1c2luZyB0aGUgcHJveHkuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClVwZGF0ZWQgUGFja2FnZXM6CgogVGhp cyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lvbiA0LjguCgogSW4gYWRkaXRpb24sIHBhdGNo ZXMgYWRkcmVzc2luZyB0aGlzIHByb2JsZW0gZm9yIHRoZSBzdGFibGUKIHJlbGVhc2VzIGNhbiBi ZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2ZXM6CgpTcXVpZCA0OgogPGh0dHA6Ly93d3cuc3F1 aWQtY2FjaGUub3JnL1ZlcnNpb25zL3Y0L2NoYW5nZXNldHMvc3F1aWQtNC1kZDQ2YjU0MTc4MDk2 NDdmNTYxZDhhNWUwZTc0YzNhYWNkMjM1MjU4LnBhdGNoPgoKIElmIHlvdSBhcmUgdXNpbmcgYSBw cmVwYWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNlIHJlZmVyCiB0byB0aGUgcGFj a2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0eSBpbmZvcm1hdGlvbiBvbiB1cGRhdGVkCiBwYWNr YWdlcy4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwoKRGV0ZXJtaW5pbmcgaWYgeW91ciB2ZXJzaW9uIGlzIHZ1bG5lcmFi bGU6CgogQWxsIFNxdWlkLTIueCB1cCB0byBhbmQgaW5jbHVkaW5nIDIuNy4wU1RBQkxFOSBiZWlu ZyB1c2VkIGZvcgogQmFzaWMgQXV0aGVudGljYXRpb24gYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNx dWlkLTMueCB1cCB0byBhbmQgaW5jbHVkaW5nIDMuNS4yOCBiZWluZyB1c2VkIGZvciBCYXNpYwog QXV0aGVudGljYXRpb24gYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTQueCB1cCB0byBhbmQg aW5jbHVkaW5nIDQuNyBiZWluZyB1c2VkIGZvciBCYXNpYwogQXV0aGVudGljYXRpb24gYXJlIHZ1 bG5lcmFibGUuCgoKVG8gZGV0ZXJtaW5lIHdoZXRoZXIgYXV0aF9wYXJhbSBpcyBjb25maWd1cmVk IGZvciBCYXNpYwphdXRoZW50aWNhdGlvbiBpbiBTcXVpZC0zLjIgYW5kIGxhdGVyIHVzZSB0aGUg Y29tbWFuZDoKCiBzcXVpZCAtayBwYXJzZSB8IGdyZXAgYXV0aF9wYXJhbQoKClRvIGRldGVybWlu ZSB3aGV0aGVyIGF1dGhfcGFyYW0gaXMgY29uZmlndXJlZCBmb3IgQmFzaWMKYXV0aGVudGljYXRp b24gaW4gU3F1aWQtMy4xIGFuZCBvbGRlciB1c2UgdGhlIGNvbW1hbmQ6CgogZ3JlcCBhdXRoX3Bh cmFtIC9ldGMvc3F1aWQvc3F1aWQuY29uZgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpXb3JrYXJvdW5kczoKCkVpdGhl cjsKCiBSZW1vdmUgJ2F1dGhfcGFyYW0gYmFzaWMgLi4uJyBjb25maWd1cmF0aW9uIHNldHRpbmdz IGZyb20KIHNxdWlkLmNvbmYuCgpPciwKCiBCdWlsZCBTcXVpZC0zLjIuMTQgYW5kIGxhdGVyIHZl cnNpb25zIHdpdGggLS1kaXNhYmxlLWF1dGgtYmFzaWMKCgpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNvbnRhY3QgZGV0 YWlscyBmb3IgdGhlIFNxdWlkIHByb2plY3Q6CgogRm9yIGluc3RhbGxhdGlvbiAvIHVwZ3JhZGUg c3VwcG9ydCBvbiBiaW5hcnkgcGFja2FnZWQgdmVyc2lvbnMKIG9mIFNxdWlkOiBZb3VyIGZpcnN0 IHBvaW50IG9mIGNvbnRhY3Qgc2hvdWxkIGJlIHlvdXIgYmluYXJ5CiBwYWNrYWdlIHZlbmRvci4K CiBJZiB5b3VyIGluc3RhbGwgYW5kIGJ1aWxkIFNxdWlkIGZyb20gdGhlIG9yaWdpbmFsIFNxdWlk IHNvdXJjZXMKIHRoZW4gdGhlIHNxdWlkLXVzZXJzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWls aW5nIGxpc3QgaXMgeW91cgogcHJpbWFyeSBzdXBwb3J0IHBvaW50LiBGb3Igc3Vic2NyaXB0aW9u IGRldGFpbHMgc2VlCiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvU3VwcG9ydC9tYWlsaW5n LWxpc3RzLmh0bWw+LgoKIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhl IGxhdGVzdCBTVEFCTEUgcmVsZWFzZQogdGhlIHNxdWlkIGJ1Z3ppbGxhIGRhdGFiYXNlIHNob3Vs ZCBiZSB1c2VkCiA8aHR0cDovL2J1Z3Muc3F1aWQtY2FjaGUub3JnLz4uCgogRm9yIHJlcG9ydGlu ZyBvZiBzZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogc3F1aWQt YnVnc0BsaXN0cy5zcXVpZC1jYWNoZS5vcmcgbWFpbGluZyBsaXN0LiBJdCdzIGEgY2xvc2VkCiBs aXN0ICh0aG91Z2ggYW55b25lIGNhbiBwb3N0KSBhbmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVw b3J0cwogYXJlIHRyZWF0ZWQgaW4gY29uZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVu IGVzdGFibGlzaGVkLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpDcmVkaXRzOgoKIFRoaXMgdnVsbmVyYWJpbGl0eSB3 YXMgZGlzY292ZXJlZCBieSBKZXJpa28gT25lCiA8amVyaWtvLm9uZUBnbXgudXM+LgoKIEZpeGVk IGJ5IEFtb3MgSmVmZnJpZXMgb2YgVHJlZWhvdXNlIE5ldHdvcmtzIEx0ZC4KCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoK UmV2aXNpb24gaGlzdG9yeToKCiAyMDE5LTA1LTE0IDE0OjU2OjQ5IFVUQyBJbml0aWFsIFJlcG9y dAogMjAxOS0wNS0yMSAyMTozMTozMSBVVEMgUGF0Y2hlcyBSZWxlYXNlZAogMjAxOS0wNi0wNSAx NTo1MjoxNyBVVEMgQ1ZFIEFzc2lnbm1lbnQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxp c3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVp ZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1aWQtYW5ub3VuY2UK