[ADVISORY] SQUID-2020:11 HTTP Request Smuggling

Amos Jeffries <[email protected]> Fri, 5 Mar 2021 03:43:14 +1300
Newsgroups gmane.comp.web.squid.announce
Message-ID <7d4014d2-2be5-d435-e587-081596ea5902__32760.5151267321$1620651290$gmane$org@treenet.co.nz>
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fCgogICAgIFNxdWlkIFByb3h5IENhY2hlIFNlY3VyaXR5IFVwZGF0ZSBBZHZpc29y
eSBTUVVJRC0yMDIwOjExCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fXwoKQWR2aXNvcnkgSUQ6ICAgICAgIHwgU1FVSUQtMjAy
MDoxMQpEYXRlOiAgICAgICAgICAgICAgfCBPY3QgNCwgMjAyMApTdW1tYXJ5OiAgICAgICAgICAg
fCBIVFRQIFJlcXVlc3QgU211Z2dsaW5nCkFmZmVjdGVkIHZlcnNpb25zOiB8IFNxdWlkIDIueCAt
PiAyLjcuU1RBQkxFOQogICAgICAgICAgICAgICAgICAgIHwgU3F1aWQgMy54IC0+IDMuNS4yOAog
ICAgICAgICAgICAgICAgICAgIHwgU3F1aWQgNC54IC0+IDQuMTMKICAgICAgICAgICAgICAgICAg
ICB8IFNxdWlkIDUueCAtPiA1LjAuNApGaXhlZCBpbiB2ZXJzaW9uOiAgfCBTcXVpZCA0LjE0IGFu
ZCA1LjAuNQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX18KCiAgIDxodHRwOi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2ZW5h
bWUuY2dpP25hbWU9Q1ZFLTIwMjAtMjUwOTc+Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlv
bjoKCiAgRHVlIHRvIGltcHJvcGVyIGlucHV0IHZhbGlkYXRpb24gU3F1aWQgaXMgdnVsbmVyYWJs
ZSB0byBhbiBIVFRQCiAgUmVxdWVzdCBTbXVnZ2xpbmcgYXR0YWNrLgoKX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZl
cml0eToKCiAgVGhpcyBwcm9ibGVtIGFsbG93cyBhIHRydXN0ZWQgY2xpZW50IHRvIHBlcmZvcm0g
SFRUUCBSZXF1ZXN0CiAgU211Z2dsaW5nIGFuZCBhY2Nlc3Mgc2VydmljZXMgb3RoZXJ3aXNlIGZv
cmJpZGRlbiBieSBTcXVpZAogIHNlY3VyaXR5IGNvbnRyb2xzLgoKQ1ZTUyBTY29yZSBvZiA5LjMK
PGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4tbWV0cmljcy9jdnNzL3YzLWNhbGN1bGF0b3I/dmVj
dG9yPUFWOk4vQUM6TC9QUjpOL1VJOk4vUzpDL0M6SC9JOk4vQTpOL0U6Ri9STDpPL1JDOkMvQ1I6
SC9JUjpYL0FSOlgvTUFWOk4vTUFDOkwvTVBSOk4vTVVJOk4vTVM6Qy9NQzpIL01JOlgvTUE6WCZ2
ZXJzaW9uPTMuMT4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fXwoKVXBkYXRlZCBQYWNrYWdlczoKCiAgVGhpcyBidWcgaXMg
Zml4ZWQgYnkgU3F1aWQgdmVyc2lvbnMgNC4xNCBhbmQgNS4wLjUuCgogIEluIGFkZGl0aW9uLCBw
YXRjaGVzIGFkZHJlc3NpbmcgdGhpcyBwcm9ibGVtIGZvciB0aGUgc3RhYmxlCiAgcmVsZWFzZXMg
Y2FuIGJlIGZvdW5kIGluIG91ciBwYXRjaCBhcmNoaXZlczoKClNxdWlkIDQ6CiAgPGh0dHA6Ly93
d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3Y0L2NoYW5nZXNldHMvU1FVSUQtMjAyMF8xMS5w
YXRjaD4KCiAgSWYgeW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQg
dGhlbiBwbGVhc2UgcmVmZXIKICB0byB0aGUgcGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0
eSBpbmZvcm1hdGlvbiBvbiB1cGRhdGVkCiAgcGFja2FnZXMuCgpfX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkRldGVybWlu
aW5nIGlmIHlvdXIgdmVyc2lvbiBpcyB2dWxuZXJhYmxlOgoKICBBbGwgU3F1aWQgd2l0aCBzcXVp
ZC5jb25mIGNvbnRhaW5pbmcgInVyaV93aGl0ZXNwYWNlIGRlbnkiIGFyZQogIG5vdCB2dWxuZXJh
YmxlLgoKICBBbGwgU3F1aWQgd2l0aCBzcXVpZC5jb25mIGNvbnRhaW5pbmcgInVyaV93aGl0ZXNw
YWNlIGVuY29kZSIgYXJlCiAgbm90IHZ1bG5lcmFibGUuCgogIEFsbCBTcXVpZC00LnggdXAgdG8g
YW5kIGluY2x1ZGluZyA0LjEzIHdpdGhvdXQgdXJpX3doaXRlc3BhY2UgaW4KICBzcXVpZC5jb25m
IGFyZSB2dWxuZXJhYmxlLgoKICBBbGwgU3F1aWQtNC54IHVwIHRvIGFuZCBpbmNsdWRpbmcgNC4x
MyB3aXRoIHVyaV93aGl0ZXNwYWNlIGluCiAgc3F1aWQuY29uZiBjb25maWd1cmVkIHRvICJhbGxv
dyIgYXJlIHZ1bG5lcmFibGUuCgogIEFsbCBTcXVpZC00LnggdXAgdG8gYW5kIGluY2x1ZGluZyA0
LjEzIHdpdGggdXJpX3doaXRlc3BhY2UgaW4KICBzcXVpZC5jb25mIGNvbmZpZ3VyZWQgdG8gImNo
b3AiIGFyZSB2dWxuZXJhYmxlLgoKICBBbGwgU3F1aWQtNC54IHVwIHRvIGFuZCBpbmNsdWRpbmcg
NC4xMyB3aXRoIHVyaV93aGl0ZXNwYWNlIGluCiAgc3F1aWQuY29uZiBjb25maWd1cmVkIHRvICJz
dHJpcCIgYXJlIHZ1bG5lcmFibGUuCgogIEFsbCBTcXVpZC01LnggdXAgdG8gYW5kIGluY2x1ZGlu
ZyA1LjAuNCB3aXRob3V0IHVyaV93aGl0ZXNwYWNlCiAgaW4gc3F1aWQuY29uZiBhcmUgdnVsbmVy
YWJsZS4KCiAgQWxsIFNxdWlkLTUueCB1cCB0byBhbmQgaW5jbHVkaW5nIDUuMC40IHdpdGggdXJp
X3doaXRlc3BhY2UgaW4KICBzcXVpZC5jb25mIGNvbmZpZ3VyZWQgdG8gImFsbG93IiBhcmUgdnVs
bmVyYWJsZS4KCiAgQWxsIFNxdWlkLTUueCB1cCB0byBhbmQgaW5jbHVkaW5nIDUuMC40IHdpdGgg
dXJpX3doaXRlc3BhY2UgaW4KICBzcXVpZC5jb25mIGNvbmZpZ3VyZWQgdG8gImNob3AiIGFyZSB2
dWxuZXJhYmxlLgoKICBBbGwgU3F1aWQtNS54IHVwIHRvIGFuZCBpbmNsdWRpbmcgNS4wLjQgd2l0
aCB1cmlfd2hpdGVzcGFjZSBpbgogIHNxdWlkLmNvbmYgY29uZmlndXJlZCB0byAic3RyaXAiIGFy
ZSB2dWxuZXJhYmxlLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fCgpXb3JrYXJvdW5kOgoKRWl0aGVyLAoKICAgQ29uZmln
dXJlIHNxdWlkLmNvbmYgd2l0aCB1cmlfd2hpdGVzcGFjZSBkZW55CgpPciwKCiAgIENvbmZpZ3Vy
ZSBzcXVpZC5jb25mIHdpdGggdXJpX3doaXRlc3BhY2UgZW5jb2RlCgpfX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNvbnRh
Y3QgZGV0YWlscyBmb3IgdGhlIFNxdWlkIHByb2plY3Q6CgogIEZvciBpbnN0YWxsYXRpb24gLyB1
cGdyYWRlIHN1cHBvcnQgb24gYmluYXJ5IHBhY2thZ2VkIHZlcnNpb25zCiAgb2YgU3F1aWQ6IFlv
dXIgZmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKICBwYWNrYWdl
IHZlbmRvci4KCiAgSWYgeW91IGluc3RhbGwgYW5kIGJ1aWxkIFNxdWlkIGZyb20gdGhlIG9yaWdp
bmFsIFNxdWlkIHNvdXJjZXMKICB0aGVuIHRoZSA8c3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2Fj
aGUub3JnPiBtYWlsaW5nIGxpc3QgaXMgeW91cgogIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9y
IHN1YnNjcmlwdGlvbiBkZXRhaWxzIHNlZQogIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9T
dXBwb3J0L21haWxpbmctbGlzdHMuaHRtbD4uCgogIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3Vy
aXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBTVEFCTEUgcmVsZWFzZQogIHRoZSBzcXVpZCBidWd6aWxs
YSBkYXRhYmFzZSBzaG91bGQgYmUgdXNlZAogIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcv
Pi4KCiAgRm9yIHJlcG9ydGluZyBvZiBzZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVt
YWlsIHRvIHRoZQogIDxzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZz4gbWFpbGluZyBs
aXN0LiBJdCdzIGEgY2xvc2VkCiAgbGlzdCAodGhvdWdoIGFueW9uZSBjYW4gcG9zdCkgYW5kIHNl
Y3VyaXR5IHJlbGF0ZWQgYnVnIHJlcG9ydHMKICBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVu
dGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6
CgogIFRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieSBKaWFuanVuIENoZW4gZnJv
bSBJQ1NJLAogIEJlcmtlbGV5LgoKICBGaXhlZCBieSBBbW9zIEplZmZyaWVzIG9mIFRyZWVob3Vz
ZSBOZXR3b3JrcyBMdGQgYW5kCiAgQWxleCBSb3Vzc2tvdiBvZiBUaGUgTWVhc3VyZW1lbnQgRmFj
dG9yeS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fXwoKUmV2aXNpb24gaGlzdG9yeToKCiAgMjAyMC0wOS0wMSAwMzo1ODoz
NiBVVEMgSW5pdGlhbCBSZXBvcnQKICAyMDIwLTA5LTAzIDAzOjAzOjI0IFVUQyBDVkUgQWxsb2Nh
dGlvbgogIDIwMjAtMDktMDQgMDQ6Mzg6MzAgVVRDIFBhdGNoZXMgcmVsZWFzZWQKX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
CkVORApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzcXVp
ZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUu
b3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1aWQtYW5ub3VuY2UK