[ADVISORY] SQUID-2021:2 Denial of Service in HTTP Response Processing
[email protected] Tue, 11 May 2021 00:40:58 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <1f452afd8db7e5da14d58c450af4bd8b__46420.3225959622$1620651656$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgIFNxdWlkIFByb3h5IENhY2hlIFNlY3VyaXR5IFVwZGF0ZSBBZHZpc29y eSBTUVVJRC0yMDIxOjIKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgfCBTUVVJRC0yMDIx OjIKRGF0ZTogICAgICAgICAgICAgIHwgTWF5IDEwLCAyMDIxClN1bW1hcnk6ICAgICAgICAgICB8 IERlbmlhbCBvZiBTZXJ2aWNlIGluIEhUVFAgUmVzcG9uc2UgUHJvY2Vzc2luZwpBZmZlY3RlZCB2 ZXJzaW9uczogfCBTcXVpZCA0LnggLT4gNC4xNAogICAgICAgICAgICAgICAgICAgIHwgU3F1aWQg NS54IC0+IDUuMC41CkZpeGVkIGluIHZlcnNpb246ICB8IFNxdWlkIDQuMTUsIDUuMC42Cl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXwoKICAgPGh0dHA6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1D VkUtMjAyMS0yODY2Mj4KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpQcm9ibGVtIERlc2NyaXB0aW9uOgoKICBEdWUgdG8g YW4gaW5wdXQgdmFsaWRhdGlvbiBidWcgU3F1aWQgaXMgdnVsbmVyYWJsZSB0byBhIERlbmlhbAog IG9mIFNlcnZpY2UgYWdhaW5zdCBhbGwgY2xpZW50cyB1c2luZyB0aGUgcHJveHkuCgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KClNldmVyaXR5OgoKICBUaGlzIHByb2JsZW0gYWxsb3dzIGEgcmVtb3RlIHNlcnZlciB0byBw ZXJmb3JtIERlbmlhbCBvZiBTZXJ2aWNlCiAgd2hlbiBkZWxpdmVyaW5nIEhUVFAgUmVzcG9uc2Ug bWVzc2FnZXMuIFRoZSBpc3N1ZSB0cmlnZ2VyIGlzIGEKICBoZWFkZXIgd2hpY2ggY2FuIGJlIGV4 cGVjdGVkIHRvIGV4aXN0IGluIEhUVFAgdHJhZmZpYyB3aXRob3V0IGFueQogIG1hbGljaW91cyBp bnRlbnQgYnkgdGhlIHNlcnZlci4KCkNWU1MgU2NvcmUgb2YgNy45CjxodHRwczovL252ZC5uaXN0 Lmdvdi92dWxuLW1ldHJpY3MvY3Zzcy92My1jYWxjdWxhdG9yP3ZlY3Rvcj1BVjpOL0FDOkwvUFI6 Ti9VSTpSL1M6VS9DOk4vSTpOL0E6SC9FOlgvUkw6Ty9SQzpDL0NSOlgvSVI6WC9BUjpIL01BVjpO L01BQzpML01QUjpOL01VSTpSL01TOlUvTUM6Ti9NSTpOL01BOkgmdmVyc2lvbj0zLjE+CgpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18KClVwZGF0ZWQgUGFja2FnZXM6CgogIFRoaXMgYnVnIGlzIGZpeGVkIGJ5IFNxdWlkIHZl cnNpb25zIDQuMTUgYW5kIDUuMC42LgoKICBJbiBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5n IHRoaXMgcHJvYmxlbSBmb3IgdGhlIHN0YWJsZQogIHJlbGVhc2VzIGNhbiBiZSBmb3VuZCBpbiBv dXIgcGF0Y2ggYXJjaGl2ZXM6CgpTcXVpZCA0OgogIAo8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5v cmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9zcXVpZC00LWIxYzM3YzllN2IzMGQwZWZiNWU1Y2Nm ODIwMGYyYTY0NmI5YzM2ZjgucGF0Y2g+CgogIElmIHlvdSBhcmUgdXNpbmcgYSBwcmVwYWNrYWdl ZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNlIHJlZmVyCiAgdG8gdGhlIHBhY2thZ2UgdmVu ZG9yIGZvciBhdmFpbGFiaWxpdHkgaW5mb3JtYXRpb24gb24gdXBkYXRlZAogIHBhY2thZ2VzLgoK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZlcnNpb24gaXMgdnVsbmVyYWJsZToKCiAg QWxsIFNxdWlkIG9sZGVyIHRoYW4gNC4wIGFyZSBub3QgdnVsbmVyYWJsZS4KCiAgQWxsIFNxdWlk LTQueCB1cCB0byBhbmQgaW5jbHVkaW5nIDQuMTQgYXJlIHZ1bG5lcmFibGUuCgogIEFsbCBTcXVp ZC01LnggdXAgdG8gYW5kIGluY2x1ZGluZyA1LjAuNSBhcmUgdnVsbmVyYWJsZS4KCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwoKV29ya2Fyb3VuZDoKCiAgVGhlcmUgYXJlIG5vIGtub3duIHdvcmthcm91bmRzIGZvciB0aGlz IHZ1bG5lcmFiaWxpdHkuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18KCkNvbnRhY3QgZGV0YWlscyBmb3IgdGhlIFNxdWlk IHByb2plY3Q6CgogIEZvciBpbnN0YWxsYXRpb24gLyB1cGdyYWRlIHN1cHBvcnQgb24gYmluYXJ5 IHBhY2thZ2VkIHZlcnNpb25zCiAgb2YgU3F1aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2YgY29udGFj dCBzaG91bGQgYmUgeW91ciBiaW5hcnkKICBwYWNrYWdlIHZlbmRvci4KCiAgSWYgeW91IGluc3Rh bGwgYW5kIGJ1aWxkIFNxdWlkIGZyb20gdGhlIG9yaWdpbmFsIFNxdWlkIHNvdXJjZXMKICB0aGVu IHRoZSA8c3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2FjaGUub3JnPiBtYWlsaW5nIGxpc3QgaXMg eW91cgogIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNjcmlwdGlvbiBkZXRhaWxzIHNl ZQogIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9TdXBwb3J0L21haWxpbmctbGlzdHMuaHRt bD4uCgogIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBT VEFCTEUgcmVsZWFzZQogIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFzZSBzaG91bGQgYmUgdXNl ZAogIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4KCiAgRm9yIHJlcG9ydGluZyBvZiBz ZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogIDxzcXVpZC1idWdz QGxpc3RzLnNxdWlkLWNhY2hlLm9yZz4gbWFpbGluZyBsaXN0LiBJdCdzIGEgY2xvc2VkCiAgbGlz dCAodGhvdWdoIGFueW9uZSBjYW4gcG9zdCkgYW5kIHNlY3VyaXR5IHJlbGF0ZWQgYnVnIHJlcG9y dHMKICBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4g ZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6CgogIFRoaXMgdnVsbmVyYWJpbGl0eSB3 YXMgZGlzY292ZXJlZCBieSBKb3NodWEgUm9nZXJzIG9mIE9wZXJhCiAgU29mdHdhcmUuCgogIEZp eGVkIGJ5IEFsZXggUm91c3Nrb3Ygb2YgVGhlIE1lYXN1cmVtZW50IEZhY3RvcnkuCgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KClJldmlzaW9uIGhpc3Rvcnk6CgogIDIwMjEtMDMtMDggMTk6NDU6MTQgVVRDIEluaXRpYWwg UmVwb3J0CiAgMjAyMS0wMy0xNiAxNTo0NToxMSBVVEMgUGF0Y2ggUmVsZWFzZWQKICAyMDIxLTAz LTE4IDAxOjMzOjUwIFVUQyBDVkUgQWxsb2NhdGlvbgpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRU5ECl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91bmNlIG1haWxp bmcgbGlzdApzcXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0cDovL2xpc3Rz LnNxdWlkLWNhY2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=