[ADVISORY] SQUID-2020:6 Denial of Service issue in TLS Handshake
Amos Jeffries <[email protected]> Sat, 20 Jun 2020 00:16:25 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <762ee5f4-ef01-9f7b-d8f8-1a5b0c259a69__41097.0153099456$1592570175$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMjA6NgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCiBBZHZpc29yeSBJRDogICAgICAgfCBTUVVJRC0yMDIw OjYKIERhdGU6ICAgICAgICAgICAgICB8IEp1bmUgMTksIDIwMjAKIFN1bW1hcnk6ICAgICAgICAg ICB8IERlbmlhbCBvZiBTZXJ2aWNlIGlzc3VlIGluIFRMUyBIYW5kc2hha2UKIEFmZmVjdGVkIHZl cnNpb25zOiB8IFNxdWlkIDMuMSAtPiAzLjUuMjgKICAgICAgICAgICAgICAgICAgICB8IFNxdWlk IDQueCAtPiA0LjExCiAgICAgICAgICAgICAgICAgICAgfCBTcXVpZCA1LnggLT4gNS4wLjIKIEZp eGVkIGluIHZlcnNpb246ICB8IFNxdWlkIDQuMTIgYW5kIDUuMC4zCgpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCiAgPGh0 dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL0Fkdmlzb3JpZXMvU1FVSUQtMjAyMF82LnR4dD4KICA8 aHR0cDovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDIwLTE0 MDU4PgoKPGh0dHBzOi8vZ2l0aHViLmNvbS9zcXVpZC1jYWNoZS9zcXVpZC9zZWN1cml0eS9hZHZp c29yaWVzL0dIU0EtcXZmNi00ODVxLXZtNTc+Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlv bjoKCiBEdWUgdG8gdXNlIG9mIGEgcG90ZW50aWFsbHkgZGFuZ2Vyb3VzIGZ1bmN0aW9uIFNxdWlk IGFuZCB0aGUKIGRlZmF1bHQgY2VydGlmaWNhdGUgdmFsaWRhdGlvbiBoZWxwZXIgYXJlIHZ1bG5l cmFibGUgdG8gYSBEZW5pYWwKIG9mIFNlcnZpY2UgYXR0YWNrIHdoZW4gcHJvY2Vzc2luZyBUTFMg Y2VydGlmaWNhdGVzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZlcml0eToKCiBUaGlzIHByb2JsZW0gYWxsb3dz IGEgdHJ1c3RlZCBjbGllbnQgdG8gcGVyZm9ybSBEZW5pYWwgb2YgU2VydmljZQogd2hlbiBvcGVu aW5nIFRMUyBjb25uZWN0aW9ucyB3aXRoIGEgc2VydmVyIGZvciBIVFRQUy4KCiBUaGlzIHByb2Js ZW0gYWxsb3dzIGEgdHJ1c3RlZCBjbGllbnQgdG8gcGVyZm9ybSBEZW5pYWwgb2YgU2VydmljZQog d2hlbiBvcGVuaW5nIFRMUyBjb25uZWN0aW9ucyB0byBhIHNlcnZlciBmb3IgU1NMLUJ1bXAgaW50 ZXJjZXB0ZWQKIHRyYW5zYWN0aW9ucy4KCiBUaGlzIGF0dGFjayBpcyBsaW1pdGVkIHRvIFNxdWlk IGJ1aWx0IHdpdGggT3BlblNTTCBmZWF0dXJlcyBhbmQKIG9wZW5pbmcgcGVlciBvciBzZXJ2ZXIg Y29ubmVjdGlvbnMgZm9yIEhUVFBTIHRyYWZmaWMgYW5kIFNTTC1CdW1wCiBzZXJ2ZXIgaGFuZHNo YWtlcy4KCiBDVlNTIFNjb3JlIG9mIDguMwogPGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4tbWV0 cmljcy9jdnNzL3YzLWNhbGN1bGF0b3I/dmVjdG9yPUFWOk4vQUM6TC9QUjpOL1VJOk4vUzpDL0M6 Ti9JOk4vQTpIL0U6Ri9STDpPL1JDOkMvQ1I6WC9JUjpYL0FSOkgvTUFWOk4vTUFDOkgvTVBSOk4v TVVJOlgvTVM6Qy9NQzpOL01JOk4vTUE6SCZ2ZXJzaW9uPTMuMT4KCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKVXBkYXRl ZCBQYWNrYWdlczoKClRoaXMgYnVnIGlzIGZpeGVkIGJ5IFNxdWlkIHZlcnNpb25zIDQuMTIgYW5k IDUuMC4zLgoKIEluIGFkZGl0aW9uLCBwYXRjaGVzIGFkZHJlc3NpbmcgdGhpcyBwcm9ibGVtIGZv ciB0aGUgc3RhYmxlCiByZWxlYXNlcyBjYW4gYmUgZm91bmQgaW4gb3VyIHBhdGNoIGFyY2hpdmVz OgoKU3F1aWQgNDoKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92NC9jaGFu Z2VzZXRzL3NxdWlkLTQtOTNmNWZkYTEzNGEyYTAxMGI4NGZmZWRiZTgzM2Q2NzBlNjNiYTRiZS5w YXRjaD4KClNxdWlkIDU6CiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjUv Y2hhbmdlc2V0cy9zcXVpZC01LWM2ZDFhNGY2YTJjYmViY2VlYmM4YTNmY2Q4ZjUzOWNlYjdiN2Y3 MjMucGF0Y2g+CgogSWYgeW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1 aWQgdGhlbiBwbGVhc2UgcmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmls aXR5IGluZm9ybWF0aW9uIG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1p bmluZyBpZiB5b3VyIHZlcnNpb24gaXMgdnVsbmVyYWJsZToKCiBBbGwgU3F1aWQtMi54IHVwIHRv IGFuZCBpbmNsdWRpbmcgMi43LlNUQUJMRTkgYXJlIG5vdCB2dWxuZXJhYmxlLgoKIEFsbCBTcXVp ZC0zLnggdXAgdG8gYW5kIGluY2x1ZGluZyAzLjQuMTQgYnVpbHQgd2l0aG91dAogLS1lbmFibGUt b3BlbnNzbCBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMueCB1cCB0byBhbmQgaW5j bHVkaW5nIDMuNC4xNCBidWlsdCB3aXRoCiAtLWRpc2FibGUtb3BlbnNzbCBhcmUgbm90IHZ1bG5l cmFibGUuCgogQWxsIFNxdWlkLTMueCB1cCB0byBhbmQgaW5jbHVkaW5nIDMuNC4xNCBidWlsdCB3 aXRoCiAtLWVuYWJsZS1vcGVuc3NsIGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjUgdXAg dG8gYW5kIGluY2x1ZGluZyAzLjUuMjggYnVpbHQgd2l0aG91dAogLS13aXRoLW9wZW5zc2wgYXJl IG5vdCB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjUgdXAgdG8gYW5kIGluY2x1ZGluZyAzLjUu MjggYnVpbHQgd2l0aAogLS13aXRob3V0LW9wZW5zc2wgYXJlIG5vdCB2dWxuZXJhYmxlLgoKIEFs bCBTcXVpZC0zLjUgdXAgdG8gYW5kIGluY2x1ZGluZyAzLjUuMjggYnVpbHQgd2l0aAogLS13aXRo LW9wZW5zc2wgYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTQueCB1cCB0byBhbmQgaW5jbHVk aW5nIDQuMTEgYnVpbHQgd2l0aG91dAogLS13aXRoLW9wZW5zc2wgYXJlIG5vdCB2dWxuZXJhYmxl LgoKIEFsbCBTcXVpZC00LnggdXAgdG8gYW5kIGluY2x1ZGluZyA0LjExIGJ1aWx0IHdpdGgKIC0t d2l0aG91dC1vcGVuc3NsIGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtNC54IHVwIHRv IGFuZCBpbmNsdWRpbmcgNC4xMSBidWlsdCB3aXRoIC0td2l0aC1vcGVuc3NsCiBhcmUgdnVsbmVy YWJsZS4KCiBTcXVpZC01LjAuMSBhbmQgNS4wLjIgYnVpbHQgd2l0aG91dCAtLXdpdGgtb3BlbnNz bCBhcmUgbm90CiB2dWxuZXJhYmxlLgoKIFNxdWlkLTUuMC4xIGFuZCA1LjAuMiBidWlsdCB3aXRo IC0td2l0aG91dC1vcGVuc3NsIGFyZSBub3QKIHZ1bG5lcmFibGUuCgogU3F1aWQtNS4wLjEgYW5k IDUuMC4yIGJ1aWx0IHdpdGggLS13aXRoLW9wZW5zc2wgYXJlIHZ1bG5lcmFibGUuCgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KCldvcmthcm91bmQ6CgogKiBGb3IgaW50ZXJjZXB0aW9uIHByb3hpZXMgdXNpbmcgU1NMLUJ1 bXAgZnVuY3Rpb25hbGl0eSB0aGVyZSBpcwogICBubyB3b3JrYXJvdW5kLgoKICogRm9yIHJldmVy c2UtcHJveHkgdGhlIEdudVRMUyBzdXBwb3J0IGF2YWlsYWJsZSBpbiBTcXVpZC00IG1heQogICBw cm92aWRlIHN1ZmZpY2llbnQgZnVuY3Rpb25hbGl0eS4gVGhlIHZ1bG5lcmFibGUgY2VydGlmaWNh dGUKICAgdmFsaWRhdG9yIGhlbHBlciBmZWF0dXJlIGlzIG5vdCBzdXBwb3J0ZWQgeWV0IGJ5IEdu dVRMUyBidWlsZHMuCgogKiBPdGhlciBpbnN0YWxsYXRpb25zIGp1c3QgbmVlZGluZyB0byByZWxh eSBIVFRQUyBkbyBub3QgbmVlZAogICBPcGVuU1NMIHN1cHBvcnQgYW5kIHNob3VsZCBiZSBhYmxl IHRvIHJ1biBhIGJ1aWxkIHRoYXQgZG9lcyBub3QKICAgaGF2ZSAtLXdpdGgtb3BlbnNzbC4KCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwoKQ29udGFjdCBkZXRhaWxzIGZvciB0aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5z dGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwog b2YgU3F1aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5h cnkKIHBhY2thZ2UgdmVuZG9yLgoKIElmIHlvdSBpbnN0YWxsIGFuZCBidWlsZCBTcXVpZCBmcm9t IHRoZSBvcmlnaW5hbCBTcXVpZCBzb3VyY2VzCiB0aGVuIHRoZSA8c3F1aWQtdXNlcnNAbGlzdHMu c3F1aWQtY2FjaGUub3JnPiBtYWlsaW5nIGxpc3QgaXMgeW91cgogcHJpbWFyeSBzdXBwb3J0IHBv aW50LiBGb3Igc3Vic2NyaXB0aW9uIGRldGFpbHMgc2VlCiA8aHR0cDovL3d3dy5zcXVpZC1jYWNo ZS5vcmcvU3VwcG9ydC9tYWlsaW5nLWxpc3RzLmh0bWw+LgoKIEZvciByZXBvcnRpbmcgb2Ygbm9u LXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBTVEFCTEUgcmVsZWFzZQogdGhlIHNxdWlkIGJ1 Z3ppbGxhIGRhdGFiYXNlIHNob3VsZCBiZSB1c2VkCiA8aHR0cDovL2J1Z3Muc3F1aWQtY2FjaGUu b3JnLz4uCgogRm9yIHJlcG9ydGluZyBvZiBzZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFu IGVtYWlsIHRvIHRoZQogPHNxdWlkLWJ1Z3NAbGlzdHMuc3F1aWQtY2FjaGUub3JnPiBtYWlsaW5n IGxpc3QuIEl0J3MgYSBjbG9zZWQKIGxpc3QgKHRob3VnaCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBz ZWN1cml0eSByZWxhdGVkIGJ1ZyByZXBvcnRzCiBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVu dGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6 CgogVGhpcyB2dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVkIGJ5IERpbWl0cmEgQXphcmlhZGkg YW5kIE1hcmlvCiBHYWxsaSBvZiBPcGVuIFN5c3RlbXMgQUcuCgogRml4ZWQgYnkgQ2hyaXN0b3Mg VHNhbnRpbGFzIG9mIFRoZSBNZWFzdXJlbWVudCBGYWN0b3J5LgoKX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpSZXZpc2lv biBoaXN0b3J5OgoKIDIwMjAtMDMtMDQgMDk6MzE6MjMgVVRDIEluaXRpYWwgUmVwb3J0CiAyMDIw LTA1LTE1IDA0OjU0OjU0IFVUQyBQYXRjaGVzIFJlbGVhc2VkCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpFTkQKX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc3F1aWQtYW5ub3VuY2Ug bWFpbGluZyBsaXN0CnNxdWlkLWFubm91bmNlQGxpc3RzLnNxdWlkLWNhY2hlLm9yZwpodHRwOi8v bGlzdHMuc3F1aWQtY2FjaGUub3JnL2xpc3RpbmZvL3NxdWlkLWFubm91bmNlCg==