Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25097: A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling. This issue could allow a trusted client to perform an HTTP request smuggling attack and access services otherwise forbidden by squid. The highest threat from this vulnerability is to data confidentiality. 1939925: CVE-2020-25097 squid: improper input validation may allow a trusted client to perform HTTP request smuggling
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | squid | 7:3.5.20-17.amzn2.6.1 |
| Amazon Linux · 2 | squid-debuginfo | 7:3.5.20-17.amzn2.6.1 |
| Amazon Linux · 2 | squid-migration-script | 7:3.5.20-17.amzn2.6.1 |
| Amazon Linux · 2 | squid-sysvinit | 7:3.5.20-17.amzn2.6.1 |
Vulnerabilities 1
-
Unscored —
An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trus…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-25097.html