[ADVISORY] SQUID-2019:11 Information Disclosure issue in HTTP Digest Authentication
Amos Jeffries <[email protected]> Sat, 9 Nov 2019 04:01:46 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <6957cd43-ae02-b641-78e4-7130ee95e4b9__8857.92441419966$1573226431$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6MTEKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgIFNRVUlELTIwMTk6 MTEKRGF0ZTogICAgICAgICAgICAgICBOb3ZlbWJlciAwNSwgMjAxOQpTdW1tYXJ5OiAgICAgICAg ICAgIEluZm9ybWF0aW9uIERpc2Nsb3N1cmUgaXNzdWUKICAgICAgICAgICAgICAgICAgICBpbiBI VFRQIERpZ2VzdCBBdXRoZW50aWNhdGlvbi4KQWZmZWN0ZWQgdmVyc2lvbnM6ICBTcXVpZCAyLngg LT4gMi43LlNUQUJMRTkKICAgICAgICAgICAgICAgICAgICBTcXVpZCAzLnggLT4gMy41LjI4CiAg ICAgICAgICAgICAgICAgICAgU3F1aWQgNC54IC0+IDQuOApGaXhlZCBpbiB2ZXJzaW9uOiAgIFNx dWlkIDQuOQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9BZHZpc29y aWVzL1NRVUlELTIwMTlfMTEudHh0CiAgICBodHRwOi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2 ZW5hbWUuY2dpP25hbWU9Q1ZFLTIwMTktMTg2NzkKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpQcm9ibGVtIERlc2NyaXB0 aW9uOgoKIER1ZSB0byBpbmNvcnJlY3QgZGF0YSBtYW5hZ2VtZW50IFNxdWlkIGlzIHZ1bG5lcmFi bGUgdG8gYQogaW5mb3JtYXRpb24gZGlzY2xvc3VyZSB3aGVuIHByb2Nlc3NpbmcgSFRUUCBEaWdl c3QKIEF1dGhlbnRpY2F0aW9uLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZlcml0eToKCiBOb25jZSB0b2tlbnMg Y29udGFpbiB0aGUgcmF3IGJ5dGUgdmFsdWUgb2YgYSBwb2ludGVyIHdoaWNoIHNpdHMKIHdpdGhp biBoZWFwIG1lbW9yeSBhbGxvY2F0aW9uLiBUaGlzIGluZm9ybWF0aW9uIHJlZHVjZXMgQVNMUgog cHJvdGVjdGlvbnMgYW5kIG1heSBhaWQgYXR0YWNrZXJzIGlzb2xhdGluZyBtZW1vcnkgYXJlYXMg dG8KIHRhcmdldCBmb3IgcmVtb3RlIGNvZGUgZXhlY3V0aW9uIGF0dGFja3MuCgpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K ClVwZGF0ZWQgUGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lvbiA0 LjkuCgogSW4gYWRkaXRpb24sIGEgcGF0Y2ggYWRkcmVzc2luZyB0aGlzIHByb2JsZW0gZm9yIHRo ZSBzdGFibGUKIHJlbGVhc2VzIGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2ZXM6CgpT cXVpZCA0OgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3Y0L2NoYW5nZXNl dHMvc3F1aWQtNC02NzFiYTk3YWJlOTI5MTU2ZGM0YzcxN2VlNTJhZDIyZmJhMGY3NDQzLnBhdGNo PgoKIElmIHlvdSBhcmUgdXNpbmcgYSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4g cGxlYXNlIHJlZmVyCiB0byB0aGUgcGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0eSBpbmZv cm1hdGlvbiBvbiB1cGRhdGVkCiBwYWNrYWdlcy4KCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKRGV0ZXJtaW5pbmcgaWYg eW91ciB2ZXJzaW9uIGlzIHZ1bG5lcmFibGU6CgogQWxsIFNxdWlkLTIueCB1cCB0byBhbmQgaW5j bHVkaW5nIDIuNy5TVEFCTEU5IGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLnggdXAgdG8g YW5kIGluY2x1ZGluZyAzLjUuMjggYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTQueCB1cCB0 byBhbmQgaW5jbHVkaW5nIDQuOCBhcmUgdnVsbmVyYWJsZS4KCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKV29ya2Fyb3Vu ZHM6CgpFaXRoZXI7CgogUmVtb3ZlICdhdXRoX3BhcmFtIGRpZ2VzdCAuLi4nIGNvbmZpZ3VyYXRp b24gc2V0dGluZ3MgZnJvbQogc3F1aWQuY29uZi4KCk9yLAoKIEJ1aWxkIFNxdWlkIHdpdGggLS1k aXNhYmxlLWF1dGgtZGlnZXN0CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNvbnRhY3QgZGV0YWlscyBmb3IgdGhlIFNx dWlkIHByb2plY3Q6CgogRm9yIGluc3RhbGxhdGlvbiAvIHVwZ3JhZGUgc3VwcG9ydCBvbiBiaW5h cnkgcGFja2FnZWQgdmVyc2lvbnMKIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9mIGNvbnRh Y3Qgc2hvdWxkIGJlIHlvdXIgYmluYXJ5CiBwYWNrYWdlIHZlbmRvci4KCiBJZiB5b3VyIGluc3Rh bGwgYW5kIGJ1aWxkIFNxdWlkIGZyb20gdGhlIG9yaWdpbmFsIFNxdWlkIHNvdXJjZXMKIHRoZW4g dGhlIHNxdWlkLXVzZXJzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QgaXMgeW91 cgogcHJpbWFyeSBzdXBwb3J0IHBvaW50LiBGb3Igc3Vic2NyaXB0aW9uIGRldGFpbHMgc2VlCiA8 aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvU3VwcG9ydC9tYWlsaW5nLWxpc3RzLmh0bWw+LgoK IEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBTVEFCTEUg cmVsZWFzZQogdGhlIHNxdWlkIGJ1Z3ppbGxhIGRhdGFiYXNlIHNob3VsZCBiZSB1c2VkCiA8aHR0 cDovL2J1Z3Muc3F1aWQtY2FjaGUub3JnLz4uCgogRm9yIHJlcG9ydGluZyBvZiBzZWN1cml0eSBz ZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogc3F1aWQtYnVnc0BsaXN0cy5zcXVp ZC1jYWNoZS5vcmcgbWFpbGluZyBsaXN0LiBJdCdzIGEgY2xvc2VkCiBsaXN0ICh0aG91Z2ggYW55 b25lIGNhbiBwb3N0KSBhbmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVwb3J0cwogYXJlIHRyZWF0 ZWQgaW4gY29uZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVzdGFibGlzaGVkLgoK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgpDcmVkaXRzOgoKIFRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBh bmQgZml4ZWQgYnkgRGF2aWQgRmlmaWVsZC4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUmV2aXNpb24gaGlzdG9yeToK CiAyMDE5LTA4LTA1IDA2OjE1OjM2IFVUQyBJbml0aWFsIFJlcG9ydAogMjAxOS0xMC0yMCAxODo1 OTowOCBVVEMgUGF0Y2hlcyBSZWxlYXNlZAogMjAxOS0xMS0wNCAxMzo0MzoyMiBVVEMgQ1ZFIEFz c2lnbm1lbnQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VA bGlzdHMuc3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGlu Zm8vc3F1aWQtYW5ub3VuY2UK