[ADVISORY] SQUID-2019:9 Cross-Site Request Forgery issue in HTTP Request processing
Amos Jeffries <[email protected]> Sat, 9 Nov 2019 03:54:41 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <b1919f7f-9adf-93bf-35aa-99752c2c3102__23067.6589229674$1573226111$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6OQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxOTo5 CkRhdGU6ICAgICAgICAgICAgICAgTm92ZW1iZXIgMDUsIDIwMTkKU3VtbWFyeTogICAgICAgICAg ICBDcm9zcy1TaXRlIFJlcXVlc3QgRm9yZ2VyeSBpc3N1ZQogICAgICAgICAgICAgICAgICAgIGlu IEhUVFAgUmVxdWVzdCBwcm9jZXNzaW5nLgpBZmZlY3RlZCB2ZXJzaW9uczogIFNxdWlkIDIueCAt PiAyLjcuU1RBQkxFOQogICAgICAgICAgICAgICAgICAgIFNxdWlkIDMueCAtPiAzLjUuMjgKICAg ICAgICAgICAgICAgICAgICBTcXVpZCA0LnggLT4gNC44CkZpeGVkIGluIHZlcnNpb246ICAgU3F1 aWQgNC45Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwoKICAgIGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL0Fkdmlzb3Jp ZXMvU1FVSUQtMjAxOV85LnR4dAogICAgaHR0cDovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVu YW1lLmNnaT9uYW1lPUNWRS0yMDE5LTE4Njc3Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlv bjoKCiBEdWUgdG8gaW5jb3JyZWN0IG1lc3NhZ2UgcHJvY2Vzc2luZyBTcXVpZCBjb25maWd1cmVk IHdpdGgKIGFwcGVuZF9kb21haW4gY2FuIGluYXBwcm9wcmlhdGVseSByZWRpcmVjdCB0cmFmZmlj IHRvIG9yaWdpbnMgaXQKIHNob3VsZCBub3QgYmUgZGVsaXZlcmVkIHRvLgoKX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpT ZXZlcml0eToKCiBUaGlzIGlzc3VlIGFsbG93cyBhdHRhY2tlcnMgdG8gaGlkZSBvcmlnaW4gc2Vy dmVycyBmb3IgcGhpc2hpbmcKIGF0dGFja3Mgb3IgbWFsd2FyZSBkb3dubG9hZCBVUkxzLgoKIFRo aXMgaXNzdWUgaXMgcmVzdHJpY3RlZCB0byBwcm94aWVzIHdpdGggYXBwZW5kX2RvbWFpbgogY29u ZmlndXJlZC4gSXQgaXMgcmVsYXRpdmVseSBlYXN5IGZvciBhdHRhY2tlcnMgdG8gcHJvYmUgYW5k CiBkZXRlcm1pbmUgd2hldGhlciBhIHRhcmdldCBuZXR3b3JrIHByb3h5IGhhcyB0aGlzIGRpcmVj dGl2ZQogYWxvbmcgd2l0aCBpdHMgdmFsdWUuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClVwZGF0ZWQgUGFja2FnZXM6 CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lvbiA0LjkuCgogSW4gYWRkaXRpb24s IHBhdGNoZXMgYWRkcmVzc2luZyB0aGlzIHByb2JsZW0gZm9yIHRoZSBzdGFibGUKIHJlbGVhc2Vz IGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2ZXM6CgpTcXVpZCAzLjU6CiA8aHR0cDov L3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjMvMy41L2NoYW5nZXNldHMvc3F1aWQtMy41 LWU1ZjE4MTNhNjc0ODQ4ZGRlNTcwZjc5MjA4NzNlMTA3MWY5NmUwYjQucGF0Y2g+CgpTcXVpZCA0 OgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3Y0L2NoYW5nZXNldHMvc3F1 aWQtNC0zNjQ5MjAzM2VhNDA5NzgyMWE0ZjdmZjNkZGNiOTcxZmJkMWU4YmEwLnBhdGNoPgoKIElm IHlvdSBhcmUgdXNpbmcgYSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNl IHJlZmVyCiB0byB0aGUgcGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0eSBpbmZvcm1hdGlv biBvbiB1cGRhdGVkCiBwYWNrYWdlcy4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKRGV0ZXJtaW5pbmcgaWYgeW91ciB2 ZXJzaW9uIGlzIHZ1bG5lcmFibGU6CgogQWxsIFNxdWlkIHdpdGhvdXQgYXBwZW5kX2RvbWFpbiBj b25maWd1cmVkIGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtMi54IHVwIHRvIGFuZCBp bmNsdWRpbmcgMi43LlNUQUJMRTkgd2l0aCBhcHBlbmRfZG9tYWluCiBjb25maWd1cmVkIGFyZSB2 dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLnggdXAgdG8gYW5kIGluY2x1ZGluZyAzLjUuMjggd2l0 aCBhcHBlbmRfZG9tYWluCiBjb25maWd1cmVkIGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC00 LnggdXAgdG8gYW5kIGluY2x1ZGluZyA0Ljggd2l0aCBhcHBlbmRfZG9tYWluCiBjb25maWd1cmVk IGFyZSB2dWxuZXJhYmxlLgoKClRvIGRldGVybWluZSB3aGV0aGVyIGFwcGVuZF9kb21haW4gaXMg Y29uZmlndXJlZCB1c2UgdGhlIGNvbW1hbmQ6Cgogc3F1aWQgLWsgcGFyc2UgfCBncmVwIGFwcGVu ZF9kb21haW4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXwoKV29ya2Fyb3VuZHM6CgogUmVtb3ZlIGFwcGVuZF9kb21haW4g Y29uZmlndXJhdGlvbiBzZXR0aW5ncyBmcm9tIHNxdWlkLmNvbmYuCgogVGhlIGFwcGVuZF9kb21h aW4gZmVhdHVyZSBpcyByZWR1bmRhbnQgd2hlbiAvZXRjL3Jlc29sdi5jb25mCiBpcyB1c2VkIHRv IGRldGVybWluZSBob3N0bmFtZXMuIEhvd2V2ZXIsIHBsZWFzZSBub3RlIHRoYXQgdXNlCiBvZiAv ZXRjL3Jlc29sdi5jb25mIG1heSByZXF1aXJlIHJlbW92YWwgb2YgZG5zX25hbWVzZXJ2ZXJzIGFu ZAogb3RoZXIgcmVkdW5kYW50IEROUyBkaXJlY3RpdmVzLgoKX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpDb250YWN0IGRl dGFpbHMgZm9yIHRoZSBTcXVpZCBwcm9qZWN0OgoKIEZvciBpbnN0YWxsYXRpb24gLyB1cGdyYWRl IHN1cHBvcnQgb24gYmluYXJ5IHBhY2thZ2VkIHZlcnNpb25zCiBvZiBTcXVpZDogWW91ciBmaXJz dCBwb2ludCBvZiBjb250YWN0IHNob3VsZCBiZSB5b3VyIGJpbmFyeQogcGFja2FnZSB2ZW5kb3Iu CgogSWYgeW91ciBpbnN0YWxsIGFuZCBidWlsZCBTcXVpZCBmcm9tIHRoZSBvcmlnaW5hbCBTcXVp ZCBzb3VyY2VzCiB0aGVuIHRoZSBzcXVpZC11c2Vyc0BsaXN0cy5zcXVpZC1jYWNoZS5vcmcgbWFp bGluZyBsaXN0IGlzIHlvdXIKIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNjcmlwdGlv biBkZXRhaWxzIHNlZQogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1N1cHBvcnQvbWFpbGlu Zy1saXN0cy5odG1sPi4KCiBGb3IgcmVwb3J0aW5nIG9mIG5vbi1zZWN1cml0eSBidWdzIGluIHRo ZSBsYXRlc3QgU1RBQkxFIHJlbGVhc2UKIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFzZSBzaG91 bGQgYmUgdXNlZAogPGh0dHA6Ly9idWdzLnNxdWlkLWNhY2hlLm9yZy8+LgoKIEZvciByZXBvcnRp bmcgb2Ygc2VjdXJpdHkgc2Vuc2l0aXZlIGJ1Z3Mgc2VuZCBhbiBlbWFpbCB0byB0aGUKIHNxdWlk LWJ1Z3NAbGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdC4gSXQncyBhIGNsb3NlZAog bGlzdCAodGhvdWdoIGFueW9uZSBjYW4gcG9zdCkgYW5kIHNlY3VyaXR5IHJlbGF0ZWQgYnVnIHJl cG9ydHMKIGFyZSB0cmVhdGVkIGluIGNvbmZpZGVuY2UgdW50aWwgdGhlIGltcGFjdCBoYXMgYmVl biBlc3RhYmxpc2hlZC4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXwoKQ3JlZGl0czoKCiBUaGlzIHZ1bG5lcmFiaWxpdHkg d2FzIGRpc2NvdmVyZWQgYnkgS3Jpc3RvZmZlciBEYW5pZWxzc29uLgoKIEZpeGVkIGJ5IEFtb3Mg SmVmZnJpZXMgb2YgVHJlZWhvdXNlIE5ldHdvcmtzIEx0ZC4KCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUmV2aXNpb24g aGlzdG9yeToKCiAyMDE5LTA2LTI2IDIxOjQzOjQ5IFVUQyBJbml0aWFsIFJlcG9ydAogMjAxOS0w Ny0xMiAwMzowODowMCBVVEMgUGF0Y2hlcyBSZWxlYXNlZAogMjAxOS0xMS0wNCAxMzo0MzoyMiBV VEMgQ1ZFLTIwMTktMTg2NzcgQXNzaWdubWVudApfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRU5ECl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91bmNlIG1haWxpbmcg bGlzdApzcXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0cDovL2xpc3RzLnNx dWlkLWNhY2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=