[ADVISORY] SQUID-2021:5 Denial of Service in HTTP Response Processing
[email protected] Tue, 11 May 2021 00:46:42 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <c2593db6716cd41dc0c279fe2e24fa2a__39364.144443401$1620651906$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgpTcXVpZCBQcm94eSBDYWNoZSBTZWN1cml0eSBVcGRhdGUgQWR2aXNvcnkgU1FV SUQtMjAyMTo1Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXwoKQWR2aXNvcnkgSUQ6ICAgICAgIHwgU1FVSUQtMjAyMTo1CkRh dGU6ICAgICAgICAgICAgICB8IE1heSAxMCwgMjAyMQpTdW1tYXJ5OiAgICAgICAgICAgfCBEZW5p YWwgb2YgU2VydmljZSBpbiBIVFRQIFJlc3BvbnNlIFByb2Nlc3NpbmcKQWZmZWN0ZWQgdmVyc2lv bnM6IHwgU3F1aWQgMi54IC0+IDIuNy5TVEFCTEU5CiAgICAgICAgICAgICAgICAgICAgfCBTcXVp ZCAzLnggLT4gMy41LjI4CiAgICAgICAgICAgICAgICAgICAgfCBTcXVpZCA0LnggLT4gNC4xNAog ICAgICAgICAgICAgICAgICAgIHwgU3F1aWQgNS54IC0+IDUuMC41CkZpeGVkIGluIHZlcnNpb246 ICB8IFNxdWlkIDQuMTUsIDUuMC42Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNj cmlwdGlvbjoKCiAgRHVlIHRvIGFuIGlucHV0IHZhbGlkYXRpb24gYnVnIFNxdWlkIGlzIHZ1bG5l cmFibGUgdG8gYSBEZW5pYWwKICBvZiBTZXJ2aWNlIGFnYWluc3QgYWxsIGNsaWVudHMgdXNpbmcg dGhlIHByb3h5LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fCgpTZXZlcml0eToKCiAgVGhpcyBwcm9ibGVtIGFsbG93cyBh IHJlbW90ZSBzZXJ2ZXIgdG8gcGVyZm9ybSBEZW5pYWwgb2YgU2VydmljZQogIHdoZW4gZGVsaXZl cmluZyBIVFRQIFJlc3BvbnNlIG1lc3NhZ2VzLiBUaGUgaXNzdWUgdHJpZ2dlciBpcyBhCiAgaGVh ZGVyIHdoaWNoIGNhbiBiZSBleHBlY3RlZCB0byBleGlzdCBpbiBIVFRQIHRyYWZmaWMgd2l0aG91 dAogIGFueSBtYWxpY2lvdXMgaW50ZW50IGJ5IHRoZSBzZXJ2ZXIuCgpDVlNTIFNjb3JlIG9mIDgu OAo8aHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi1tZXRyaWNzL2N2c3MvdjMtY2FsY3VsYXRvcj92 ZWN0b3I9QVY6Ti9BQzpML1BSOkwvVUk6Ti9TOlUvQzpOL0k6Ti9BOkgvRTpQL1JMOk8vUkM6Qy9D UjpYL0lSOlgvQVI6SC9NQVY6Ti9NQUM6TC9NUFI6TC9NVUk6Ti9NUzpDL01DOlgvTUk6WC9NQTpI JnZlcnNpb249My4xPgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpVcGRhdGVkIFBhY2thZ2VzOgoKVGhpcyBidWcgaXMg Zml4ZWQgYnkgU3F1aWQgdmVyc2lvbnMgNC4xNSBhbmQgNS4wLjYuCgogIEluIGFkZGl0aW9uLCBw YXRjaGVzIGFkZHJlc3NpbmcgdGhpcyBwcm9ibGVtIGZvciB0aGUgc3RhYmxlCiAgcmVsZWFzZXMg Y2FuIGJlIGZvdW5kIGluIG91ciBwYXRjaCBhcmNoaXZlczoKClNxdWlkIDQ6CiAgCjxodHRwOi8v d3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92NC9jaGFuZ2VzZXRzL3NxdWlkLTQtMWUwNWE4 NWJkMjhjMjJjOWNhNWQzYWM5ZjVlODZkNjI2OWVjMGE4Yy5wYXRjaD4KClNxdWlkIDU6CiAgCjxo dHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92NS9jaGFuZ2VzZXRzL3NxdWlkLTUt OGFmNzc1ZWQ5OGJmZDYxMGY5Y2U3NjJmZTE3N2UwMWIyNjc1NTg4Yy5wYXRjaD4KCiAgSWYgeW91 IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVhc2UgcmVm ZXIKICB0byB0aGUgcGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0eSBpbmZvcm1hdGlvbiBv biB1cGRhdGVkCiAgcGFja2FnZXMuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkRldGVybWluaW5nIGlmIHlvdXIgdmVy c2lvbiBpcyB2dWxuZXJhYmxlOgoKICBTcXVpZCBvbGRlciB0aGFuIDQuMTUgaGF2ZSBub3QgYmVl biB0ZXN0ZWQgYW5kIHNob3VsZCBiZQogIGFzc3VtZWQgdG8gYmUgdnVsbmVyYWJsZS4KCiAgQWxs IFNxdWlkLTUueCB1cCB0byBhbmQgaW5jbHVkaW5nIDUuMC41IGFyZSB2dWxuZXJhYmxlLgoKX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fCgpXb3JrYXJvdW5kOgoKICBUaGVyZSBhcmUgbm8ga25vd24gd29ya2Fyb3VuZHMgdG8g dGhpcyBpc3N1ZS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwoKQ29udGFjdCBkZXRhaWxzIGZvciB0aGUgU3F1aWQgcHJv amVjdDoKCiAgRm9yIGluc3RhbGxhdGlvbiAvIHVwZ3JhZGUgc3VwcG9ydCBvbiBiaW5hcnkgcGFj a2FnZWQgdmVyc2lvbnMKICBvZiBTcXVpZDogWW91ciBmaXJzdCBwb2ludCBvZiBjb250YWN0IHNo b3VsZCBiZSB5b3VyIGJpbmFyeQogIHBhY2thZ2UgdmVuZG9yLgoKICBJZiB5b3UgaW5zdGFsbCBh bmQgYnVpbGQgU3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogIHRoZW4gdGhl IDxzcXVpZC11c2Vyc0BsaXN0cy5zcXVpZC1jYWNoZS5vcmc+IG1haWxpbmcgbGlzdCBpcyB5b3Vy CiAgcHJpbWFyeSBzdXBwb3J0IHBvaW50LiBGb3Igc3Vic2NyaXB0aW9uIGRldGFpbHMgc2VlCiAg PGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1N1cHBvcnQvbWFpbGluZy1saXN0cy5odG1sPi4K CiAgRm9yIHJlcG9ydGluZyBvZiBub24tc2VjdXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNUQUJM RSByZWxlYXNlCiAgdGhlIHNxdWlkIGJ1Z3ppbGxhIGRhdGFiYXNlIHNob3VsZCBiZSB1c2VkCiAg PGh0dHA6Ly9idWdzLnNxdWlkLWNhY2hlLm9yZy8+LgoKICBGb3IgcmVwb3J0aW5nIG9mIHNlY3Vy aXR5IHNlbnNpdGl2ZSBidWdzIHNlbmQgYW4gZW1haWwgdG8gdGhlCiAgPHNxdWlkLWJ1Z3NAbGlz dHMuc3F1aWQtY2FjaGUub3JnPiBtYWlsaW5nIGxpc3QuIEl0J3MgYSBjbG9zZWQKICBsaXN0ICh0 aG91Z2ggYW55b25lIGNhbiBwb3N0KSBhbmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVwb3J0cwog IGFyZSB0cmVhdGVkIGluIGNvbmZpZGVuY2UgdW50aWwgdGhlIGltcGFjdCBoYXMgYmVlbiBlc3Rh Ymxpc2hlZC4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXwoKQ3JlZGl0czoKCiAgVGhpcyB2dWxuZXJhYmlsaXR5IHdhcyBk aXNjb3ZlcmVkIGJ5IEpvc2h1YSBSb2dlcnMgb2YgT3BlcmEKICBTb2Z0d2FyZS4KCiAgRml4ZWQg YnkgQWxleCBSb3Vzc2tvdiBvZiBUaGUgTWVhc3VyZW1lbnQgRmFjdG9yeS4KCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoK UmV2aXNpb24gaGlzdG9yeToKCiAgMjAyMS0wMy0wNSAyMjoxMTo0MyBVVEMgSW5pdGlhbCBSZXBv cnQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMu c3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1 aWQtYW5ub3VuY2UK