[ADVISORY] SQUID-2019:10 HTTP Request Splitting issue in HTTP message processing
Amos Jeffries <[email protected]> Sat, 9 Nov 2019 03:56:57 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <8d9b16ec-cec9-57dc-7f95-971dc6fc3888__6905.44948899827$1573226358$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6MTAKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgIFNRVUlELTIwMTk6 MTAKRGF0ZTogICAgICAgICAgICAgICBOb3ZlbWJlciAwNSwgMjAxOQpTdW1tYXJ5OiAgICAgICAg ICAgIEhUVFAgUmVxdWVzdCBTcGxpdHRpbmcgaXNzdWUKICAgICAgICAgICAgICAgICAgICBpbiBI VFRQIG1lc3NhZ2UgcHJvY2Vzc2luZy4KQWZmZWN0ZWQgdmVyc2lvbnM6ICBTcXVpZCAzLjAgLT4g My41LjI4CiAgICAgICAgICAgICAgICAgICAgU3F1aWQgNC54IC0+IDQuOApGaXhlZCBpbiB2ZXJz aW9uOiAgIFNxdWlkIDQuOQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9y Zy9BZHZpc29yaWVzL1NRVUlELTIwMTlfMTAudHh0CiAgICBodHRwOi8vY3ZlLm1pdHJlLm9yZy9j Z2ktYmluL2N2ZW5hbWUuY2dpP25hbWU9Q1ZFLTIwMTktMTg2NzgKX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpQcm9ibGVt IERlc2NyaXB0aW9uOgoKIER1ZSB0byBpbmNvcnJlY3QgbWVzc2FnZSBwYXJzaW5nIFNxdWlkIGlz IHZ1bG5lcmFibGUgdG8gYW4gSFRUUAogcmVxdWVzdCBzcGxpdHRpbmcgaXNzdWUuCgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KClNldmVyaXR5OgoKIFRoaXMgaXNzdWUgYWxsb3dzIGF0dGFja2VycyB0byBzbXVnZ2xlIEhU VFAgcmVxdWVzdHMgdGhyb3VnaAogZnJvbnRlbmQgc29mdHdhcmUgdG8gYSBTcXVpZCB3aGljaCBz cGxpdHMgdGhlIEhUVFAgUmVxdWVzdAogcGlwZWxpbmUgZGlmZmVyZW50bHkuIFRoZSByZXN1bHRp bmcgUmVzcG9uc2UgbWVzc2FnZXMgY29ycnVwdAogY2FjaGVzIGJldHdlZW4gY2xpZW50IGFuZCBT cXVpZCB3aXRoIGF0dGFja2VyIGNvbnRyb2xsZWQgY29udGVudAogYXQgYXJiaXRyYXJ5IFVSTHMu LgoKIEVmZmVjdHMgYXJlIGlzb2xhdGVkIHRvIHNvZnR3YXJlIGJldHdlZW4gdGhlIGF0dGFja2Vy IGNsaWVudCBhbmQKIFNxdWlkLiBUaGVyZSBhcmUgbm8gZWZmZWN0cyBvbiBTcXVpZCBpdHNlbGYs IG5vciBhbnkgdXBzdHJlYW0KIHNlcnZlcnMuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClVwZGF0ZWQgUGFja2FnZXM6 CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lvbiA0LjkuCgogSW4gYWRkaXRpb24s IGEgcGF0Y2ggYWRkcmVzc2luZyB0aGlzIHByb2JsZW0gZm9yIHRoZSBzdGFibGUKIHJlbGVhc2Vz IGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2ZXM6CgpTcXVpZCA0OgogPGh0dHA6Ly93 d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3Y0L2NoYW5nZXNldHMvc3F1aWQtNC02NzFiYTk3 YWJlOTI5MTU2ZGM0YzcxN2VlNTJhZDIyZmJhMGY3NDQzLnBhdGNoPgoKIElmIHlvdSBhcmUgdXNp bmcgYSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNlIHJlZmVyCiB0byB0 aGUgcGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0eSBpbmZvcm1hdGlvbiBvbiB1cGRhdGVk CiBwYWNrYWdlcy4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwoKRGV0ZXJtaW5pbmcgaWYgeW91ciB2ZXJzaW9uIGlzIHZ1 bG5lcmFibGU6CgogQWxsIFNxdWlkLTIueCBoYXZlIG5vdCBiZWVuIGNoZWNrZWQuCgogQWxsIFNx dWlkLTMueCB1cCB0byBhbmQgaW5jbHVkaW5nIDMuNS4yOCBhcmUgdnVsbmVyYWJsZS4KCiBBbGwg U3F1aWQtNC54IHVwIHRvIGFuZCBpbmNsdWRpbmcgNC44IGFyZSB2dWxuZXJhYmxlLgoKX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCgpXb3JrYXJvdW5kczoKCiBUaGVyZSBhcmUgbm8gd29ya2Fyb3VuZHMgZm9yIHRoaXMgdnVs bmVyYWJpbGl0eS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwoKQ29udGFjdCBkZXRhaWxzIGZvciB0aGUgU3F1aWQgcHJv amVjdDoKCiBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFyeSBwYWNr YWdlZCB2ZXJzaW9ucwogb2YgU3F1aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91 bGQgYmUgeW91ciBiaW5hcnkKIHBhY2thZ2UgdmVuZG9yLgoKIElmIHlvdXIgaW5zdGFsbCBhbmQg YnVpbGQgU3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogdGhlbiB0aGUgc3F1 aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdCBpcyB5b3VyCiBwcmlt YXJ5IHN1cHBvcnQgcG9pbnQuIEZvciBzdWJzY3JpcHRpb24gZGV0YWlscyBzZWUKIDxodHRwOi8v d3d3LnNxdWlkLWNhY2hlLm9yZy9TdXBwb3J0L21haWxpbmctbGlzdHMuaHRtbD4uCgogRm9yIHJl cG9ydGluZyBvZiBub24tc2VjdXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNUQUJMRSByZWxlYXNl CiB0aGUgc3F1aWQgYnVnemlsbGEgZGF0YWJhc2Ugc2hvdWxkIGJlIHVzZWQKIDxodHRwOi8vYnVn cy5zcXVpZC1jYWNoZS5vcmcvPi4KCiBGb3IgcmVwb3J0aW5nIG9mIHNlY3VyaXR5IHNlbnNpdGl2 ZSBidWdzIHNlbmQgYW4gZW1haWwgdG8gdGhlCiBzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hl Lm9yZyBtYWlsaW5nIGxpc3QuIEl0J3MgYSBjbG9zZWQKIGxpc3QgKHRob3VnaCBhbnlvbmUgY2Fu IHBvc3QpIGFuZCBzZWN1cml0eSByZWxhdGVkIGJ1ZyByZXBvcnRzCiBhcmUgdHJlYXRlZCBpbiBj b25maWRlbmNlIHVudGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KCkNyZWRpdHM6CgogVGhpcyB2dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVkIGJ5IGJ5IFLD g8KpZ2lzIExlcm95IChyZWdpbGVybwogZnJvbSBNYWtpbmEgQ29ycHVzKS4KCiBGaXhlZCBieSBB bW9zIEplZmZyaWVzIG9mIFRyZWVob3VzZSBOZXR3b3JrcyBMdGQuCgpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClJldmlz aW9uIGhpc3Rvcnk6CgogMjAxOS0wNy0yNCAxMTo1Mjo1MSBVVEMgSW5pdGlhbCBSZXBvcnQKIDIw MTktMDktMTEgMDI6NTI6NTIgVVRDIFBhdGNoZXMgUmVsZWFzZWQKIDIwMTktMTEtMDQgMTM6NDM6 MjIgVVRDIENWRSBBc3NpZ25tZW50Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpFTkQKX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18Kc3F1aWQtYW5ub3VuY2UgbWFpbGluZyBsaXN0CnNx dWlkLWFubm91bmNlQGxpc3RzLnNxdWlkLWNhY2hlLm9yZwpodHRwOi8vbGlzdHMuc3F1aWQtY2Fj aGUub3JnL2xpc3RpbmZvL3NxdWlkLWFubm91bmNlCg==