CVE-2020-15049

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.
HTTP Request/Response Smuggling
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
mitreCNA
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
VendorProductVersion
squid-cachesquid
2.0 ≤
𝑥
≤ 2.6
squid-cachesquid
3.1 ≤
𝑥
≤ 3.5.28
squid-cachesquid
4.0 ≤
𝑥
< 4.12
squid-cachesquid
5.0 ≤
𝑥
< 5.0.3
squid-cachesquid
2.7
squid-cachesquid
2.7:stable2
squid-cachesquid
2.7:stable3
squid-cachesquid
2.7:stable4
squid-cachesquid
2.7:stable5
squid-cachesquid
2.7:stable6
squid-cachesquid
2.7:stable7
squid-cachesquid
2.7:stable8
squid-cachesquid
2.7:stable9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
squid
bullseye (security)
4.13-10+deb11u3
fixed
bullseye
4.13-10+deb11u3
fixed
bookworm
5.7-2+deb12u2
fixed
bookworm (security)
5.7-2+deb12u2
fixed
sid
6.12-1
fixed
trixie
6.12-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
squid
hirsute
Fixed 4.12-1ubuntu1
released
groovy
Fixed 4.12-1ubuntu1
released
focal
Fixed 4.10-1ubuntu1.3
released
eoan
ignored
bionic
dne
xenial
dne
trusty
dne
squid3
hirsute
dne
groovy
dne
focal
dne
eoan
dne
bionic
Fixed 3.5.27-1ubuntu1.9
released
xenial
Fixed 3.5.12-1ubuntu7.15
released
trusty
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html
http://www.squid-cache.org/Versions/v4/changesets/squid-4-ea12a34d338b962707d5078d6d1fc7c6eb119a22.patch
http://www.squid-cache.org/Versions/v5/changesets/squid-5-485c9a7bb1bba88754e07ad0094647ea57a6eb8d.patch
https://github.com/squid-cache/squid/security/advisories/GHSA-qf3v-rc95-96j5
https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/
https://security.netapp.com/advisory/ntap-20210312-0001/
https://usn.ubuntu.com/4551-1/
https://www.debian.org/security/2020/dsa-4732
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html
http://www.squid-cache.org/Versions/v4/changesets/squid-4-ea12a34d338b962707d5078d6d1fc7c6eb119a22.patch
http://www.squid-cache.org/Versions/v5/changesets/squid-5-485c9a7bb1bba88754e07ad0094647ea57a6eb8d.patch
https://github.com/squid-cache/squid/security/advisories/GHSA-qf3v-rc95-96j5
https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/
https://security.netapp.com/advisory/ntap-20210312-0001/
https://usn.ubuntu.com/4551-1/
https://www.debian.org/security/2020/dsa-4732