[ADVISORY] SQUID-2020:10 HTTP(S) Request Smuggling
Amos Jeffries <[email protected]> Sun, 23 Aug 2020 20:17:47 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <6615617b-63ce-b25b-ae73-aea862a8ca15__47723.9543035225$1598171995$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgpTcXVpZCBQcm94eSBDYWNoZSBTZWN1cml0eSBVcGRhdGUgQWR2aXNvcnkgU1FV SUQtMjAyMDoxMApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICB8IFNRVUlELTIwMjA6MTAK RGF0ZTogICAgICAgICAgICAgIHwgQXVndXN0IDEsIDIwMjAKU3VtbWFyeTogICAgICAgICAgIHwg SFRUUChTKSBSZXF1ZXN0IFNtdWdnbGluZy4KQWZmZWN0ZWQgdmVyc2lvbnM6IHwgU3F1aWQgMi41 IC0+IDIuNy5TVEFCTEU5CiAgICAgICAgICAgICAgICAgICB8IFNxdWlkIDMueCAtPiAzLjUuMjgK ICAgICAgICAgICAgICAgICAgIHwgU3F1aWQgNC54IC0+IDQuMTIKICAgICAgICAgICAgICAgICAg IHwgU3F1aWQgNS54IC0+IDUuMC4zCkZpeGVkIGluIHZlcnNpb246ICB8IFNxdWlkIDQuMTMsIDUu MC40Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXwoKICA8aHR0cDovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1lLmNn aT9uYW1lPUNWRS0yMDIwLTE1ODEwPgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClByb2JsZW0gRGVzY3JpcHRpb246Cgog RHVlIHRvIGluY29ycmVjdCBkYXRhIHZhbGlkYXRpb24gU3F1aWQgaXMgdnVsbmVyYWJsZSB0byBI VFRQCiBSZXF1ZXN0IFNtdWdnbGluZyBhdHRhY2tzIGFnYWluc3QgSFRUUCBhbmQgSFRUUFMgdHJh ZmZpYy4gVGhpcwogbGVhZHMgdG8gY2FjaGUgcG9pc29uaW5nLgoKX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZlcml0 eToKCiBUaGlzIHByb2JsZW0gaXMgc2VyaW91cyBiZWNhdXNlIGl0IGFsbG93cyBhbnkgY2xpZW50 LCBpbmNsdWRpbmcKIGJyb3dzZXIgc2NyaXB0cywgdG8gYnlwYXNzIGxvY2FsIHNlY3VyaXR5IGFu ZCBwb2lzb24gdGhlIHByb3h5CiBjYWNoZSBhbmQgYW55IGRvd25zdHJlYW0gY2FjaGVzIHdpdGgg Y29udGVudCBmcm9tIGFuIGFyYml0cmFyeQogc291cmNlLgoKQ1ZTUyBTY29yZSBvZiA5LjMKPGh0 dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4tbWV0cmljcy9jdnNzL3YzLWNhbGN1bGF0b3I/dmVjdG9y PUFWOk4vQUM6TC9QUjpML1VJOk4vUzpDL0M6SC9JOkgvQTpOL0U6Ri9STDpPL1JDOkMvQ1I6SC9J UjpIL0FSOlgvTUFWOk4vTUFDOkwvTVBSOkwvTVVJOk4vTVM6Qy9NQzpIL01JOkgvTUE6TiZ2ZXJz aW9uPTMuMT4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXwoKVXBkYXRlZCBQYWNrYWdlczoKClRoaXMgYnVnIGlzIGZpeGVk IGJ5IFNxdWlkIHZlcnNpb25zIDQuMTMgYW5kIDUuMC40LgoKIEluIGFkZGl0aW9uLCBwYXRjaGVz IGFkZHJlc3NpbmcgdGhpcyBwcm9ibGVtIGZvciB0aGUgc3RhYmxlCiByZWxlYXNlcyBjYW4gYmUg Zm91bmQgaW4gb3VyIHBhdGNoIGFyY2hpdmVzOgoKU3F1aWQgNDoKIDxodHRwOi8vd3d3LnNxdWlk LWNhY2hlLm9yZy9WZXJzaW9ucy92NC9jaGFuZ2VzZXRzL1NRVUlELTIwMjBfMTAucGF0Y2g+Cgog SWYgeW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVh c2UgcmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmlsaXR5IGluZm9ybWF0 aW9uIG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3Vy IHZlcnNpb24gaXMgdnVsbmVyYWJsZToKCiBBbGwgU3F1aWQgd2l0aCByZWxheGVkX2hlYWRlcl9w YXJzZXIgY29uZmlndXJlZCAib2ZmIiBhcmUgbm90CiB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0z LnggdXAgdG8gYW5kIGluY2x1ZGluZyAzLjUuMjggd2l0aAogcmVsYXhlZF9oZWFkZXJfcGFyc2Vy IGNvbmZpZ3VyZWQgdG8gIm9uIiBvciAid2FybiIgYXJlCiB2dWxuZXJhYmxlLgoKIEFsbCBTcXVp ZC0zLnggdXAgdG8gYW5kIGluY2x1ZGluZyAzLjUuMjggd2l0aG91dAogcmVsYXhlZF9oZWFkZXJf cGFyc2VyIGNvbmZpZ3VyZWQgYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTQueCB1cCB0byBh bmQgaW5jbHVkaW5nIDQuMTIgd2l0aCByZWxheGVkX2hlYWRlcl9wYXJzZXIKIGNvbmZpZ3VyZWQg dG8gIm9uIiBvciAid2FybiIgYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTQueCB1cCB0byBh bmQgaW5jbHVkaW5nIDQuMTIgd2l0aG91dAogcmVsYXhlZF9oZWFkZXJfcGFyc2VyIGNvbmZpZ3Vy ZWQgYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTUueCB1cCB0byBhbmQgaW5jbHVkaW5nIDUu MC4zIHdpdGgKIHJlbGF4ZWRfaGVhZGVyX3BhcnNlciBjb25maWd1cmVkIHRvICJvbiIgb3IgIndh cm4iIGFyZQogdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtNS54IHVwIHRvIGFuZCBpbmNsdWRpbmcg NS4wLjMgd2l0aG91dAogcmVsYXhlZF9oZWFkZXJfcGFyc2VyIGNvbmZpZ3VyZWQgYXJlIHZ1bG5l cmFibGUuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KCldvcmthcm91bmQ6CgogRGlzYWJsZSB0aGUgcmVsYXhlZCBIVFRQ IHBhcnNlciBpbiBzcXVpZC5jb25mOgoKICAgIHJlbGF4ZWRfaGVhZGVyX3BhcnNlciBvZmYKCiBO b3RlLCB0cmFmZmljIHdoaWNoIGRvZXMgbm90IGNvcnJlY3RseSBvYmV5IEhUVFAgc3BlY2lmaWNh dGlvbnMKIHdpbGwgYmUgcmVqZWN0ZWQgaW5zdGVhZCBvZiBjb252ZXJ0ZWQgdG8gc3RhbmRhcmRz IGNvbXBsaWFuY2UuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkNvbnRhY3QgZGV0YWlscyBmb3IgdGhlIFNxdWlkIHBy b2plY3Q6CgogRm9yIGluc3RhbGxhdGlvbiAvIHVwZ3JhZGUgc3VwcG9ydCBvbiBiaW5hcnkgcGFj a2FnZWQgdmVyc2lvbnMKIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9mIGNvbnRhY3Qgc2hv dWxkIGJlIHlvdXIgYmluYXJ5CiBwYWNrYWdlIHZlbmRvci4KCiBJZiB5b3UgaW5zdGFsbCBhbmQg YnVpbGQgU3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogdGhlbiB0aGUgPHNx dWlkLXVzZXJzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZz4gbWFpbGluZyBsaXN0IGlzIHlvdXIKIHBy aW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNjcmlwdGlvbiBkZXRhaWxzIHNlZQogPGh0dHA6 Ly93d3cuc3F1aWQtY2FjaGUub3JnL1N1cHBvcnQvbWFpbGluZy1saXN0cy5odG1sPi4KCiBGb3Ig cmVwb3J0aW5nIG9mIG5vbi1zZWN1cml0eSBidWdzIGluIHRoZSBsYXRlc3QgU1RBQkxFIHJlbGVh c2UKIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFzZSBzaG91bGQgYmUgdXNlZAogPGh0dHA6Ly9i dWdzLnNxdWlkLWNhY2hlLm9yZy8+LgoKIEZvciByZXBvcnRpbmcgb2Ygc2VjdXJpdHkgc2Vuc2l0 aXZlIGJ1Z3Mgc2VuZCBhbiBlbWFpbCB0byB0aGUKIDxzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNh Y2hlLm9yZz4gbWFpbGluZyBsaXN0LiBJdCdzIGEgY2xvc2VkCiBsaXN0ICh0aG91Z2ggYW55b25l IGNhbiBwb3N0KSBhbmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVwb3J0cwogYXJlIHRyZWF0ZWQg aW4gY29uZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVzdGFibGlzaGVkLgoKX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fCgpDcmVkaXRzOgoKIFRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieSBB bWl0IEtsZWluIG9mIFNhZmVicmVhY2guCgogRml4ZWQgYnkgQW1vcyBKZWZmcmllcyBvZiBUcmVl aG91c2UgTmV0d29ya3MgTHRkLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKIDIwMjAt MDUtMTEgMDg6MjE6NTggVVRDIEluaXRpYWwgUmVwb3J0CiAyMDIwLTA3LTE3IDE3OjExOjUwIFVU QyBDVkUgQWxsb2NhdGVkCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXwpFTkQKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18Kc3F1aWQtYW5ub3VuY2UgbWFpbGluZyBsaXN0CnNxdWlkLWFu bm91bmNlQGxpc3RzLnNxdWlkLWNhY2hlLm9yZwpodHRwOi8vbGlzdHMuc3F1aWQtY2FjaGUub3Jn L2xpc3RpbmZvL3NxdWlkLWFubm91bmNlCg==