[ADVISORY] SQUID-2020:7 Cache Poisoning Issue in HTTP Request processing
Amos Jeffries <[email protected]> Sat, 27 Jun 2020 03:48:20 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <6fddb72c-8524-699f-455f-31ad31097585__9691.61077389202$1593189835$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgpTcXVpZCBQcm94eSBDYWNoZSBTZWN1cml0eSBVcGRhdGUgQWR2aXNvcnkgU1FV SUQtMjAyMDo3Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXwoKIEFkdmlzb3J5IElEOiAgICAgICB8IFNRVUlELTIwMjA6Nwog RGF0ZTogICAgICAgICAgICAgIHwgSnVuZSAyNiwgMjAyMAogU3VtbWFyeTogICAgICAgICAgIHwg Q2FjaGUgUG9pc29uaW5nIElzc3VlCiAgICAgICAgICAgICAgICAgICAgfCBpbiBIVFRQIFJlcXVl c3QgcHJvY2Vzc2luZy4KIEFmZmVjdGVkIHZlcnNpb25zOiB8IFNxdWlkIDIueCAtPiAyLjcuU1RB QkxFOQogICAgICAgICAgICAgICAgICAgIHwgU3F1aWQgMy54IC0+IDMuNS4yOAogICAgICAgICAg ICAgICAgICAgIHwgU3F1aWQgNC54IC0+IDQuMTEKICAgICAgICAgICAgICAgICAgICB8IFNxdWlk IDUueCAtPiA1LjAuMgogRml4ZWQgaW4gdmVyc2lvbjogIHwgU3F1aWQgNC4xMiBhbmQgNS4wLjMK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogPGh0dHBzOi8vZ2l0aHViLmNvbS9zcXVpZC1jYWNoZS9zcXVpZC9zZWN1cml0 eS9hZHZpc29yaWVzL0dIU0EtcWYzdi1yYzk1LTk2ajU+CiA8aHR0cDovL2N2ZS5taXRyZS5vcmcv Y2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDIwLTE1MDQ5PgpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClByb2Js ZW0gRGVzY3JpcHRpb246CgogRHVlIHRvIGluY29ycmVjdCBpbnB1dCB2YWxpZGF0aW9uIFNxdWlk IGlzIHZ1bG5lcmFibGUgdG8gYQogUmVxdWVzdCBTbXVnZ2xpbmcgYW5kIFBvaXNvbmluZyBhdHRh Y2sgYWdhaW5zdCB0aGUgSFRUUCBjYWNoZS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKU2V2ZXJpdHk6CgogVGhpcyBw cm9ibGVtIGFsbG93cyBhIHRydXN0ZWQgY2xpZW50IHRvIHBlcmZvcm0gcmVxdWVzdCBzbXVnZ2xp bmcKIGFuZCBwb2lzb24gdGhlIEhUVFAgY2FjaGUgY29udGVudHMgd2l0aCBjcmFmdGVkIEhUVFAo UykgcmVxdWVzdAogbWVzc2FnZXMuCgogVGhpcyBhdHRhY2sgcmVxdWlyZXMgYW4gdXBzdHJlYW0g c2VydmVyIHRvIHBhcnRpY2lwYXRlIGluIHRoZQogc211Z2dsaW5nIGFuZCBnZW5lcmF0ZSB0aGUg cG9pc29uIHJlc3BvbnNlIHNlcXVlbmNlLiBNb3N0IHBvcHVsYXIKIHNlcnZlciBzb2Z0d2FyZSBh cmUgbm90IHZ1bG5lcmFibGUgdG8gcGFydGljaXBhdGlvbiBpbiB0aGlzCiBhdHRhY2suCgpDVlNT IFNjb3JlIG9mIDkuMwo8aHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi1tZXRyaWNzL2N2c3MvdjMt Y2FsY3VsYXRvcj92ZWN0b3I9QVY6Ti9BQzpML1BSOkwvVUk6Ti9TOkMvQzpIL0k6SC9BOkgvRTpG L1JMOk8vUkM6Qy9DUjpIL0lSOkgvQVI6SC9NQVY6Ti9NQUM6TC9NUFI6TC9NVUk6Ti9NUzpDL01D OkgvTUk6SC9NQTpIJnZlcnNpb249My4xPgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpVcGRhdGVkIFBhY2thZ2VzOgoK VGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lvbnMgNC4xMiBhbmQgNS4wLjMuCgogSW4g YWRkaXRpb24sIHBhdGNoZXMgYWRkcmVzc2luZyB0aGlzIHByb2JsZW0gZm9yIHRoZSBzdGFibGUK IHJlbGVhc2VzIGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2ZXM6CgpTcXVpZCA0Ogog PGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3Y0L2NoYW5nZXNldHMvc3F1aWQt NC1lYTEyYTM0ZDMzOGI5NjI3MDdkNTA3OGQ2ZDFmYzdjNmViMTE5YTIyLnBhdGNoPgoKU3F1aWQg NToKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92NS9jaGFuZ2VzZXRzL3Nx dWlkLTUtNDg1YzlhN2JiMWJiYTg4NzU0ZTA3YWQwMDk0NjQ3ZWE1N2E2ZWI4ZC5wYXRjaD4KCiBJ ZiB5b3UgYXJlIHVzaW5nIGEgcHJlcGFja2FnZWQgdmVyc2lvbiBvZiBTcXVpZCB0aGVuIHBsZWFz ZSByZWZlcgogdG8gdGhlIHBhY2thZ2UgdmVuZG9yIGZvciBhdmFpbGFiaWxpdHkgaW5mb3JtYXRp b24gb24gdXBkYXRlZAogcGFja2FnZXMuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkRldGVybWluaW5nIGlmIHlvdXIg dmVyc2lvbiBpcyB2dWxuZXJhYmxlOgoKIEFsbCBTcXVpZC0zLnggdXAgdG8gYW5kIGluY2x1ZGlu ZyAzLjUuMjggYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTQueCB1cCB0byBhbmQgaW5jbHVk aW5nIDQuMTEgYXJlIHZ1bG5lcmFibGUuCgogU3F1aWQtNS4wLjEgYW5kIDUuMC4yIGFyZSB2dWxu ZXJhYmxlLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fCgpXb3JrYXJvdW5kOgoKIFRoZXJlIGlzIG5vIHdvcmthcm91bmQg Zm9yIHRoaXMgdnVsbmVyYWJpbGl0eS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ29udGFjdCBkZXRhaWxzIGZvciB0 aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9u IGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2YgU3F1aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2Yg Y29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKIHBhY2thZ2UgdmVuZG9yLgoKIElmIHlvdSBp bnN0YWxsIGFuZCBidWlsZCBTcXVpZCBmcm9tIHRoZSBvcmlnaW5hbCBTcXVpZCBzb3VyY2VzCiB0 aGVuIHRoZSA8c3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2FjaGUub3JnPiBtYWlsaW5nIGxpc3Qg aXMgeW91cgogcHJpbWFyeSBzdXBwb3J0IHBvaW50LiBGb3Igc3Vic2NyaXB0aW9uIGRldGFpbHMg c2VlCiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvU3VwcG9ydC9tYWlsaW5nLWxpc3RzLmh0 bWw+LgoKIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBT VEFCTEUgcmVsZWFzZQogdGhlIHNxdWlkIGJ1Z3ppbGxhIGRhdGFiYXNlIHNob3VsZCBiZSB1c2Vk CiA8aHR0cDovL2J1Z3Muc3F1aWQtY2FjaGUub3JnLz4uCgogRm9yIHJlcG9ydGluZyBvZiBzZWN1 cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogPHNxdWlkLWJ1Z3NAbGlz dHMuc3F1aWQtY2FjaGUub3JnPiBtYWlsaW5nIGxpc3QuIEl0J3MgYSBjbG9zZWQKIGxpc3QgKHRo b3VnaCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0eSByZWxhdGVkIGJ1ZyByZXBvcnRzCiBh cmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJs aXNoZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KCkNyZWRpdHM6CgogVGhpcyB2dWxuZXJhYmlsaXR5IHdhcyBkaXNj b3ZlcmVkIGJ5IEFsZXggUm91c3Nrb3Ygb2YgVGhlCiBNZWFzdXJlbWVudCBGYWN0b3J5LgoKIElu ZGVwZW5kZW50IGRpc2NvdmVyeSBhbmQgcmVwbGljYXRpb24gcmVwb3J0ZWQgYnkgQW1pdCBLbGVp biBvZgogU2FmZWJyZWFjaC4KCiBGaXhlZCBieSBBbGV4IFJvdXNza292IG9mIFRoZSBNZWFzdXJl bWVudCBGYWN0b3J5LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKCiAyMDE2LTA5LTA2 IDAyOjQ1OjIwIFVUQyBJbml0aWFsIFJlcG9ydAogMjAyMC0wNS0xMSAxMjo0MToxNyBVVEMgUmVw bGljYXRpb24gUmVwb3J0ZWQKIDIwMjAtMDUtMTMgMTQ6MDU6MDAgVVRDIFBhdGNoIFJlbGVhc2Vk CiAyMDIwLTA2LTI1IDExOjE1OjEwIFVUQyBDVkUgQWxsb2NhdGVkCl9fX19fX19fX19fX19fX19f X19fX18KRU5ECl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f CnNxdWlkLWFubm91bmNlIG1haWxpbmcgbGlzdApzcXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1j YWNoZS5vcmcKaHR0cDovL2xpc3RzLnNxdWlkLWNhY2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5v dW5jZQo=