[ADVISORY] SQUID-2020:11 HTTP Request Smuggling
Amos Jeffries <[email protected]> Fri, 5 Mar 2021 03:43:14 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <7d4014d2-2be5-d435-e587-081596ea5902__32760.5151267321$1620651290$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgIFNxdWlkIFByb3h5IENhY2hlIFNlY3VyaXR5IFVwZGF0ZSBBZHZpc29y eSBTUVVJRC0yMDIwOjExCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXwoKQWR2aXNvcnkgSUQ6ICAgICAgIHwgU1FVSUQtMjAy MDoxMQpEYXRlOiAgICAgICAgICAgICAgfCBPY3QgNCwgMjAyMApTdW1tYXJ5OiAgICAgICAgICAg fCBIVFRQIFJlcXVlc3QgU211Z2dsaW5nCkFmZmVjdGVkIHZlcnNpb25zOiB8IFNxdWlkIDIueCAt PiAyLjcuU1RBQkxFOQogICAgICAgICAgICAgICAgICAgIHwgU3F1aWQgMy54IC0+IDMuNS4yOAog ICAgICAgICAgICAgICAgICAgIHwgU3F1aWQgNC54IC0+IDQuMTMKICAgICAgICAgICAgICAgICAg ICB8IFNxdWlkIDUueCAtPiA1LjAuNApGaXhlZCBpbiB2ZXJzaW9uOiAgfCBTcXVpZCA0LjE0IGFu ZCA1LjAuNQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KCiAgIDxodHRwOi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2ZW5h bWUuY2dpP25hbWU9Q1ZFLTIwMjAtMjUwOTc+Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlv bjoKCiAgRHVlIHRvIGltcHJvcGVyIGlucHV0IHZhbGlkYXRpb24gU3F1aWQgaXMgdnVsbmVyYWJs ZSB0byBhbiBIVFRQCiAgUmVxdWVzdCBTbXVnZ2xpbmcgYXR0YWNrLgoKX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZl cml0eToKCiAgVGhpcyBwcm9ibGVtIGFsbG93cyBhIHRydXN0ZWQgY2xpZW50IHRvIHBlcmZvcm0g SFRUUCBSZXF1ZXN0CiAgU211Z2dsaW5nIGFuZCBhY2Nlc3Mgc2VydmljZXMgb3RoZXJ3aXNlIGZv cmJpZGRlbiBieSBTcXVpZAogIHNlY3VyaXR5IGNvbnRyb2xzLgoKQ1ZTUyBTY29yZSBvZiA5LjMK PGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4tbWV0cmljcy9jdnNzL3YzLWNhbGN1bGF0b3I/dmVj dG9yPUFWOk4vQUM6TC9QUjpOL1VJOk4vUzpDL0M6SC9JOk4vQTpOL0U6Ri9STDpPL1JDOkMvQ1I6 SC9JUjpYL0FSOlgvTUFWOk4vTUFDOkwvTVBSOk4vTVVJOk4vTVM6Qy9NQzpIL01JOlgvTUE6WCZ2 ZXJzaW9uPTMuMT4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwoKVXBkYXRlZCBQYWNrYWdlczoKCiAgVGhpcyBidWcgaXMg Zml4ZWQgYnkgU3F1aWQgdmVyc2lvbnMgNC4xNCBhbmQgNS4wLjUuCgogIEluIGFkZGl0aW9uLCBw YXRjaGVzIGFkZHJlc3NpbmcgdGhpcyBwcm9ibGVtIGZvciB0aGUgc3RhYmxlCiAgcmVsZWFzZXMg Y2FuIGJlIGZvdW5kIGluIG91ciBwYXRjaCBhcmNoaXZlczoKClNxdWlkIDQ6CiAgPGh0dHA6Ly93 d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3Y0L2NoYW5nZXNldHMvU1FVSUQtMjAyMF8xMS5w YXRjaD4KCiAgSWYgeW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQg dGhlbiBwbGVhc2UgcmVmZXIKICB0byB0aGUgcGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0 eSBpbmZvcm1hdGlvbiBvbiB1cGRhdGVkCiAgcGFja2FnZXMuCgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkRldGVybWlu aW5nIGlmIHlvdXIgdmVyc2lvbiBpcyB2dWxuZXJhYmxlOgoKICBBbGwgU3F1aWQgd2l0aCBzcXVp ZC5jb25mIGNvbnRhaW5pbmcgInVyaV93aGl0ZXNwYWNlIGRlbnkiIGFyZQogIG5vdCB2dWxuZXJh YmxlLgoKICBBbGwgU3F1aWQgd2l0aCBzcXVpZC5jb25mIGNvbnRhaW5pbmcgInVyaV93aGl0ZXNw YWNlIGVuY29kZSIgYXJlCiAgbm90IHZ1bG5lcmFibGUuCgogIEFsbCBTcXVpZC00LnggdXAgdG8g YW5kIGluY2x1ZGluZyA0LjEzIHdpdGhvdXQgdXJpX3doaXRlc3BhY2UgaW4KICBzcXVpZC5jb25m IGFyZSB2dWxuZXJhYmxlLgoKICBBbGwgU3F1aWQtNC54IHVwIHRvIGFuZCBpbmNsdWRpbmcgNC4x MyB3aXRoIHVyaV93aGl0ZXNwYWNlIGluCiAgc3F1aWQuY29uZiBjb25maWd1cmVkIHRvICJhbGxv dyIgYXJlIHZ1bG5lcmFibGUuCgogIEFsbCBTcXVpZC00LnggdXAgdG8gYW5kIGluY2x1ZGluZyA0 LjEzIHdpdGggdXJpX3doaXRlc3BhY2UgaW4KICBzcXVpZC5jb25mIGNvbmZpZ3VyZWQgdG8gImNo b3AiIGFyZSB2dWxuZXJhYmxlLgoKICBBbGwgU3F1aWQtNC54IHVwIHRvIGFuZCBpbmNsdWRpbmcg NC4xMyB3aXRoIHVyaV93aGl0ZXNwYWNlIGluCiAgc3F1aWQuY29uZiBjb25maWd1cmVkIHRvICJz dHJpcCIgYXJlIHZ1bG5lcmFibGUuCgogIEFsbCBTcXVpZC01LnggdXAgdG8gYW5kIGluY2x1ZGlu ZyA1LjAuNCB3aXRob3V0IHVyaV93aGl0ZXNwYWNlCiAgaW4gc3F1aWQuY29uZiBhcmUgdnVsbmVy YWJsZS4KCiAgQWxsIFNxdWlkLTUueCB1cCB0byBhbmQgaW5jbHVkaW5nIDUuMC40IHdpdGggdXJp X3doaXRlc3BhY2UgaW4KICBzcXVpZC5jb25mIGNvbmZpZ3VyZWQgdG8gImFsbG93IiBhcmUgdnVs bmVyYWJsZS4KCiAgQWxsIFNxdWlkLTUueCB1cCB0byBhbmQgaW5jbHVkaW5nIDUuMC40IHdpdGgg dXJpX3doaXRlc3BhY2UgaW4KICBzcXVpZC5jb25mIGNvbmZpZ3VyZWQgdG8gImNob3AiIGFyZSB2 dWxuZXJhYmxlLgoKICBBbGwgU3F1aWQtNS54IHVwIHRvIGFuZCBpbmNsdWRpbmcgNS4wLjQgd2l0 aCB1cmlfd2hpdGVzcGFjZSBpbgogIHNxdWlkLmNvbmYgY29uZmlndXJlZCB0byAic3RyaXAiIGFy ZSB2dWxuZXJhYmxlLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpXb3JrYXJvdW5kOgoKRWl0aGVyLAoKICAgQ29uZmln dXJlIHNxdWlkLmNvbmYgd2l0aCB1cmlfd2hpdGVzcGFjZSBkZW55CgpPciwKCiAgIENvbmZpZ3Vy ZSBzcXVpZC5jb25mIHdpdGggdXJpX3doaXRlc3BhY2UgZW5jb2RlCgpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNvbnRh Y3QgZGV0YWlscyBmb3IgdGhlIFNxdWlkIHByb2plY3Q6CgogIEZvciBpbnN0YWxsYXRpb24gLyB1 cGdyYWRlIHN1cHBvcnQgb24gYmluYXJ5IHBhY2thZ2VkIHZlcnNpb25zCiAgb2YgU3F1aWQ6IFlv dXIgZmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKICBwYWNrYWdl IHZlbmRvci4KCiAgSWYgeW91IGluc3RhbGwgYW5kIGJ1aWxkIFNxdWlkIGZyb20gdGhlIG9yaWdp bmFsIFNxdWlkIHNvdXJjZXMKICB0aGVuIHRoZSA8c3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2Fj aGUub3JnPiBtYWlsaW5nIGxpc3QgaXMgeW91cgogIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9y IHN1YnNjcmlwdGlvbiBkZXRhaWxzIHNlZQogIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9T dXBwb3J0L21haWxpbmctbGlzdHMuaHRtbD4uCgogIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3Vy aXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBTVEFCTEUgcmVsZWFzZQogIHRoZSBzcXVpZCBidWd6aWxs YSBkYXRhYmFzZSBzaG91bGQgYmUgdXNlZAogIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcv Pi4KCiAgRm9yIHJlcG9ydGluZyBvZiBzZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVt YWlsIHRvIHRoZQogIDxzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZz4gbWFpbGluZyBs aXN0LiBJdCdzIGEgY2xvc2VkCiAgbGlzdCAodGhvdWdoIGFueW9uZSBjYW4gcG9zdCkgYW5kIHNl Y3VyaXR5IHJlbGF0ZWQgYnVnIHJlcG9ydHMKICBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVu dGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6 CgogIFRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieSBKaWFuanVuIENoZW4gZnJv bSBJQ1NJLAogIEJlcmtlbGV5LgoKICBGaXhlZCBieSBBbW9zIEplZmZyaWVzIG9mIFRyZWVob3Vz ZSBOZXR3b3JrcyBMdGQgYW5kCiAgQWxleCBSb3Vzc2tvdiBvZiBUaGUgTWVhc3VyZW1lbnQgRmFj dG9yeS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwoKUmV2aXNpb24gaGlzdG9yeToKCiAgMjAyMC0wOS0wMSAwMzo1ODoz NiBVVEMgSW5pdGlhbCBSZXBvcnQKICAyMDIwLTA5LTAzIDAzOjAzOjI0IFVUQyBDVkUgQWxsb2Nh dGlvbgogIDIwMjAtMDktMDQgMDQ6Mzg6MzAgVVRDIFBhdGNoZXMgcmVsZWFzZWQKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f CkVORApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzcXVp ZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUu b3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1aWQtYW5ub3VuY2UK