[ADVISORY] SQUID-2019:6 Multiple Cross-Site Scripting issues in cachemgr.cgi
Amos Jeffries <[email protected]> Sun, 14 Jul 2019 01:33:47 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <ff25630d-7efb-0845-b171-90557a160b35__29269.5577650861$1563025226$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6NgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxOTo2 CkRhdGU6ICAgICAgICAgICAgICAgSnVseSAxMiwgMjAxOQpTdW1tYXJ5OiAgICAgICAgICAgIE11 bHRpcGxlIENyb3NzLVNpdGUgU2NyaXB0aW5nIGlzc3VlcwogICAgICAgICAgICAgICAgICAgIGlu IGNhY2hlbWdyLmNnaS4KQWZmZWN0ZWQgdmVyc2lvbnM6ICBTcXVpZCAyLnggYWxsIHJlbGVhc2Vz CiAgICAgICAgICAgICAgICAgICAgU3F1aWQgMy54IC0+IDMuNS4yOAogICAgICAgICAgICAgICAg ICAgIFNxdWlkIDQueCAtPiA0LjcKRml4ZWQgaW4gdmVyc2lvbjogICBTcXVpZCA0LjgKX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCgogICAgaHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvQWR2aXNvcmllcy9TUVVJRC0yMDE5 XzYudHh0CiAgICBodHRwOi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2ZW5hbWUuY2dpP25hbWU9 Q1ZFLTIwMTktMTMzNDUKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpQcm9ibGVtIERlc2NyaXB0aW9uOgoKIER1ZSB0byBp bmNvcnJlY3QgaW5wdXQgaGFuZGxpbmcgU3F1aWQgY2FjaGVtZ3IuY2dpIHRvb2wgaXMKIHZ1bG5l cmFibGUgdG8gbXVsdGlwbGUgY3Jvc3Mtc2l0ZSBzY3JpcHRpbmcgYXR0YWNrcy4KCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwoKU2V2ZXJpdHk6CgogVGhpcyBhbGxvd3MgYSBtYWxpY2lvdXMgc2VydmVyIHRvIGVtYmVkIFVS THMgaW4gaXRzIGNvbnRlbnQgc3VjaAogdGhhdCB1c2VyIGNyZWRlbnRpYWxzIGFuZCBvdGhlciBp bmZvcm1hdGlvbiBjYW4gYmUgZXh0cmFjdGVkIGZyb20KIGEgY2xpZW50IG9yIGFkbWluaXN0cmF0 b3Igd2l0aCBhY2Nlc3MgdG8gdGhlIFNxdWlkIGNhY2hlbWdyLmNnaQogdG9vbCBVUkwuCgpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18KClVwZGF0ZWQgUGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVy c2lvbiA0LjguCgogSW4gYWRkaXRpb24sIHBhdGNoZXMgYWRkcmVzc2luZyB0aGlzIHByb2JsZW0g Zm9yIHRoZSBzdGFibGUKIHJlbGVhc2VzIGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2 ZXM6CgpTcXVpZCAzLng6CiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjMv My41L2NoYW5nZXNldHMvc3F1aWQtMy41LTU3MzBjMmI1Y2I1NmU3NjM5ZGM0MjNkZDYyNjUxYzg3 MzZhNTRlMzUucGF0Y2g+CgpTcXVpZCA0OgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1Zl cnNpb25zL3Y0L2NoYW5nZXNldHMvc3F1aWQtNC1iZTFkYzg2MTRlNzUxNDEwM2JhODRkNDA2N2Vk NmZkMTVhYjhmODJlLnBhdGNoPgoKIElmIHlvdSBhcmUgdXNpbmcgYSBwcmVwYWNrYWdlZCB2ZXJz aW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNlIHJlZmVyCiB0byB0aGUgcGFja2FnZSB2ZW5kb3IgZm9y IGF2YWlsYWJpbGl0eSBpbmZvcm1hdGlvbiBvbiB1cGRhdGVkCiBwYWNrYWdlcy4KCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwoKRGV0ZXJtaW5pbmcgaWYgeW91ciB2ZXJzaW9uIGlzIHZ1bG5lcmFibGU6CgogU3F1aWQgcHJv eHkgaXMgbm90IHZ1bG5lcmFibGUuIFRoZSBwcm9ibGVtIGlzIGlzb2xhdGVkIHRvIHRoZQogbWFu YWdlciBDR0kgaW50ZXJmYWNlIHRvb2wuCgogY2FjaGVtZ3IuY2dpIHRvb2wgZGlzcGxheXMgaXRz IHZlcnNpb24gbnVtYmVyIGluIHRoZSBIVE1MIHBhZ2UKIGZvb3RlcjoKCiAgQWxsIDIueCB2ZXJz aW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nIDIuNy5TVEFCTEU5IGFyZSB2dWxuZXJhYmxlLgoKICBB bGwgMy54IHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcgMy41LjI4IGFyZSB2dWxuZXJhYmxl LgoKICBBbGwgNC54IHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcgNC43IGFyZSB2dWxuZXJh YmxlLgoKICBJZiB5b3VyIGNhY2hlbWdyLmNnaSBkb2VzIG5vdCBkaXNwbGF5IGEgdmVyc2lvbiBp dCBpcyBsaWtlbHkKICB0byBiZSBvbmUgb2YgdGhlIG9sZGVyIHZ1bG5lcmFibGUgdmVyc2lvbnMu CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KCldvcmthcm91bmRzOgoKRWl0aGVyOwoKIFJlbW92ZSB1c2Ugb2YgdGhlIGNh Y2hlbWdyLmNnaSB0b29sLiBJdCBpcyBvbmx5IG5lY2Vzc2FyeSBmb3IKIG9sZGVyIHByb3h5IG1h bmFnZW1lbnQuIE1vZGVybiBTcXVpZCBwcm94aWVzIG1hbmFnZW1lbnQgcmVwb3J0cwogY2FuIGJl IGFjY2Vzc2VkIGRpcmVjdGx5LgoKT3IsCgogQWRkIENPUlMgcHJvdGVjdGlvbiB0byB0aGUgd2Vi IHNlcnZlciBydW5uaW5nIHRoZSBDR0kgdG9vbCBzdWNoCiB0aGF0IHJlbW90ZSByZXF1ZXN0cyB0 byB0aGUgY2FjaGVtZ3IuY2dpIHRvb2wgY2Fubm90IHVzZQogcXVlcnktc3RyaW5nIHBhcmFtZXRl cnMuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KCkNvbnRhY3QgZGV0YWlscyBmb3IgdGhlIFNxdWlkIHByb2plY3Q6Cgog Rm9yIGluc3RhbGxhdGlvbiAvIHVwZ3JhZGUgc3VwcG9ydCBvbiBiaW5hcnkgcGFja2FnZWQgdmVy c2lvbnMKIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9mIGNvbnRhY3Qgc2hvdWxkIGJlIHlv dXIgYmluYXJ5CiBwYWNrYWdlIHZlbmRvci4KCiBJZiB5b3VyIGluc3RhbGwgYW5kIGJ1aWxkIFNx dWlkIGZyb20gdGhlIG9yaWdpbmFsIFNxdWlkIHNvdXJjZXMKIHRoZW4gdGhlIHNxdWlkLXVzZXJz QGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QgaXMgeW91cgogcHJpbWFyeSBzdXBw b3J0IHBvaW50LiBGb3Igc3Vic2NyaXB0aW9uIGRldGFpbHMgc2VlCiA8aHR0cDovL3d3dy5zcXVp ZC1jYWNoZS5vcmcvU3VwcG9ydC9tYWlsaW5nLWxpc3RzLmh0bWw+LgoKIEZvciByZXBvcnRpbmcg b2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBTVEFCTEUgcmVsZWFzZQogdGhlIHNx dWlkIGJ1Z3ppbGxhIGRhdGFiYXNlIHNob3VsZCBiZSB1c2VkCiA8aHR0cDovL2J1Z3Muc3F1aWQt Y2FjaGUub3JnLz4uCgogRm9yIHJlcG9ydGluZyBvZiBzZWN1cml0eSBzZW5zaXRpdmUgYnVncyBz ZW5kIGFuIGVtYWlsIHRvIHRoZQogc3F1aWQtYnVnc0BsaXN0cy5zcXVpZC1jYWNoZS5vcmcgbWFp bGluZyBsaXN0LiBJdCdzIGEgY2xvc2VkCiBsaXN0ICh0aG91Z2ggYW55b25lIGNhbiBwb3N0KSBh bmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVwb3J0cwogYXJlIHRyZWF0ZWQgaW4gY29uZmlkZW5j ZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVzdGFibGlzaGVkLgoKX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpDcmVk aXRzOgoKIFRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieSBBbmlsIFBhenZhbnQu CgogRml4ZWQgYnkgQW1vcyBKZWZmcmllcyBvZiBUcmVlaG91c2UgTmV0d29ya3MgTHRkLgoKX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKIDIwMTktMDUtMjcgMTM6Mzg6MDYgVVRDIEluaXRp YWwgUmVwb3J0CiAyMDE5LTA2LTA1IDE1OjUyOjE3IFVUQyBDVkUgQXNzaWdubWVudAogMjAxOS0w Ny0wNCAwMToxNzo0OCBVVEMgUGF0Y2hlcyBSZWxlYXNlZApfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRU5ECl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91bmNlIG1h aWxpbmcgbGlzdApzcXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0cDovL2xp c3RzLnNxdWlkLWNhY2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=