CVE-2019-12523
26.11.2019, 17:15
An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| squid-cache | squid | 3.0 ≤ 𝑥 ≤ 3.5.28 |
| squid-cache | squid | 4.0 ≤ 𝑥 ≤ 4.8 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.04 |
| canonical | ubuntu_linux | 19.10 |
| opensuse | leap | 15.0 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| squid |
| ||||||||||||||||
| squid3 |
|
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| squid |
| ||||
| squid-debuginfo |
| ||||
| squid-migration-script |
| ||||
| squid-sysvinit |
|
References