[ADVISORY] SQUID-2021:1 Denial of Service in URN processing

[email protected] Tue, 11 May 2021 00:39:55 +1200
Newsgroups gmane.comp.web.squid.announce
Message-ID <d77e50649a1d49c4cfc716b5abbb61d2__42609.7275152401$1620651583$gmane$org@treenet.co.nz>
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fCgogICAgIFNxdWlkIFByb3h5IENhY2hlIFNlY3VyaXR5IFVwZGF0ZSBBZHZpc29y
eSBTUVVJRC0yMDIxOjEKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgfCBTUVVJRC0yMDIx
OjEKRGF0ZTogICAgICAgICAgICAgIHwgTWF5IDEwLCAyMDIxClN1bW1hcnk6ICAgICAgICAgICB8
IERlbmlhbCBvZiBTZXJ2aWNlIGluIFVSTiBwcm9jZXNzaW5nCkFmZmVjdGVkIHZlcnNpb25zOiB8
IFNxdWlkIDIuMCAtPiA0LjE0CiAgICAgICAgICAgICAgICAgICAgfCBTcXVpZCA1LnggLT4gNS4w
LjUKRml4ZWQgaW4gdmVyc2lvbjogIHwgU3F1aWQgNC4xNSBhbmQgNS4wLjYKX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgog
ICA8aHR0cDovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDIx
LTI4NjUxPgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX18KClByb2JsZW0gRGVzY3JpcHRpb246CgogIER1ZSB0byBhIGJ1ZmZl
ciBtYW5hZ2VtZW50IGJ1ZyBTcXVpZCBpcyB2dWxuZXJhYmxlIHRvIGEKICBEZW5pYWwgb2Ygc2Vy
dmljZSBhdHRhY2sgYWdhaW5zdCB0aGUgc2VydmVyIGl0IGlzIG9wZXJhdGluZyBvbi4KCiAgVGhp
cyBhdHRhY2sgaXMgbGltaXRlZCB0byBwcm94aWVzIHdoaWNoIGF0dGVtcHQgdG8gcmVzb2x2ZSBh
CiAgInVybjoiIHJlc291cmNlIGlkZW50aWZpZXIuIFN1cHBvcnQgZm9yIHRoaXMgcmVzb2x2aW5n
IGlzIGVuYWJsZWQKICBieSBkZWZhdWx0IGluIGFsbCBTcXVpZC4KCl9fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKU2V2ZXJp
dHk6CgogIFRoaXMgcHJvYmxlbSBhbGxvd3MgYSBtYWxpY2lvdXMgc2VydmVyIGluIGNvbGxhYm9y
YXRpb24gd2l0aCBhCiAgdHJ1c3RlZCBjbGllbnQgdG8gY29uc3VtZSBhcmJpdHJhcmlseSBsYXJn
ZSBhbW91bnRzIG9mIG1lbW9yeQogIG9uIHRoZSBzZXJ2ZXIgcnVubmluZyBTcXVpZC4KCiAgTGFj
ayBvZiBhdmFpbGFibGUgbWVtb3J5IHJlc291cmNlcyBpbXBhY3RzIGFsbCBzZXJ2aWNlcyBvbiB0
aGUKICBtYWNoaW5lIHJ1bm5pbmcgU3F1aWQuIE9uY2UgaW5pdGlhdGVkIHRoZSBEb1Mgc2l0dWF0
aW9uIHdpbGwKICBwZXJzaXN0IHVudGlsIFNxdWlkIGlzIHNodXRkb3duLgoKQ1ZTUyBTY29yZSBv
ZiA4LjUKPGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4tbWV0cmljcy9jdnNzL3YzLWNhbGN1bGF0
b3I/dmVjdG9yPUFWOk4vQUM6TC9QUjpOL1VJOk4vUzpDL0M6Ti9JOk4vQTpIL0U6UC9STDpPL1JD
OkMvQ1I6WC9JUjpYL0FSOkgvTUFWOk4vTUFDOkwvTVBSOk4vTVVJOlIvTVM6Qy9NQzpYL01JOlgv
TUE6SCZ2ZXJzaW9uPTMuMT4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKVXBkYXRlZCBQYWNrYWdlczoKClRoaXMgYnVn
IGlzIGZpeGVkIGJ5IFNxdWlkIHZlcnNpb25zIDQuMTUgYW5kIDUuMC42LgoKICBJbiBhZGRpdGlv
biwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRoaXMgcHJvYmxlbSBmb3IgdGhlIHN0YWJsZQogIHJlbGVh
c2VzIGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2ZXM6CgpTcXVpZCA0OgogIAo8aHR0
cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9zcXVpZC00LWE5
NzVmZDVhZWRjODY2NjI5MjE0YWFhY2NiMzgzNzY4NTUzNTE4OTkucGF0Y2g+CgogIElmIHlvdSBh
cmUgdXNpbmcgYSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNlIHJlZmVy
CiAgdG8gdGhlIHBhY2thZ2UgdmVuZG9yIGZvciBhdmFpbGFiaWxpdHkgaW5mb3JtYXRpb24gb24g
dXBkYXRlZAogIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZlcnNp
b24gaXMgdnVsbmVyYWJsZToKCiAgU3F1aWQgb2xkZXIgdGhhbiAzLjUuMjggaGF2ZSBub3QgYmVl
biB0ZXN0ZWQgYW5kIHNob3VsZCBiZQogIGFzc3VtZWQgdG8gYmUgdnVsbmVyYWJsZS4KCiAgQWxs
IFNxdWlkLTQueCB1cCB0byBhbmQgaW5jbHVkaW5nIDQuMTQgYXJlIHZ1bG5lcmFibGUuCgogIEFs
bCBTcXVpZC01LnggdXAgdG8gYW5kIGluY2x1ZGluZyA1LjAuNSBhcmUgdnVsbmVyYWJsZS4KCl9f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fXwoKV29ya2Fyb3VuZDoKCiAgRGlzYWJsZSBVUk4gcHJvY2Vzc2luZyBieSB0aGUgcHJv
eHkuIEFkZCB0aGVzZSBsaW5lcyB0bwogIHNxdWlkLmNvbmY6CgogICAgYWNsIFVSTiBwcm90byBV
Uk4KICAgIGh0dHBfYWNjZXNzIGRlbnkgVVJOCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNvbnRhY3QgZGV0YWlscyBm
b3IgdGhlIFNxdWlkIHByb2plY3Q6CgogIEZvciBpbnN0YWxsYXRpb24gLyB1cGdyYWRlIHN1cHBv
cnQgb24gYmluYXJ5IHBhY2thZ2VkIHZlcnNpb25zCiAgb2YgU3F1aWQ6IFlvdXIgZmlyc3QgcG9p
bnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKICBwYWNrYWdlIHZlbmRvci4KCiAg
SWYgeW91IGluc3RhbGwgYW5kIGJ1aWxkIFNxdWlkIGZyb20gdGhlIG9yaWdpbmFsIFNxdWlkIHNv
dXJjZXMKICB0aGVuIHRoZSA8c3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2FjaGUub3JnPiBtYWls
aW5nIGxpc3QgaXMgeW91cgogIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNjcmlwdGlv
biBkZXRhaWxzIHNlZQogIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9TdXBwb3J0L21haWxp
bmctbGlzdHMuaHRtbD4uCgogIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4g
dGhlIGxhdGVzdCBTVEFCTEUgcmVsZWFzZQogIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFzZSBz
aG91bGQgYmUgdXNlZAogIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4KCiAgRm9yIHJl
cG9ydGluZyBvZiBzZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQog
IDxzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZz4gbWFpbGluZyBsaXN0LiBJdCdzIGEg
Y2xvc2VkCiAgbGlzdCAodGhvdWdoIGFueW9uZSBjYW4gcG9zdCkgYW5kIHNlY3VyaXR5IHJlbGF0
ZWQgYnVnIHJlcG9ydHMKICBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBpbXBh
Y3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6CgogIFRoaXMgdnVs
bmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieSBKb3NodWEgUm9nZXJzIG9mIE9wZXJhCiAgU29m
dHdhcmUuCgogIEZpeGVkIGJ5IEFtb3MgSmVmZnJpZXMgb2YgVHJlZWhvdXNlIE5ldHdvcmtzIEx0
ZC4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fXwoKUmV2aXNpb24gaGlzdG9yeToKCiAgMjAyMS0wMi0yMiAwNjo1NTozOCBV
VEMgSW5pdGlhbCBSZXBvcnQKICAyMDIxLTAyLTI0IDAwOjUzOjIxIFVUQyBQYXRjaCBSZWxlYXNl
ZAogIDIwMjEtMDMtMTcgMDY6MTk6MDkgVVRDIENWRSBBc3NpZ25tZW50Cl9fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpFTkQK
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc3F1aWQtYW5u
b3VuY2UgbWFpbGluZyBsaXN0CnNxdWlkLWFubm91bmNlQGxpc3RzLnNxdWlkLWNhY2hlLm9yZwpo
dHRwOi8vbGlzdHMuc3F1aWQtY2FjaGUub3JnL2xpc3RpbmZvL3NxdWlkLWFubm91bmNlCg==