Summary
[7:3.5.20-15]
- Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
case
- Resolves: #1680022 - squid cant display download/upload packet size for HTTPS
sites
- Resolves: #1717430 - Excessive memory usage when running out of descriptors
- Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
- Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
in cachemgr.cgi
- Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws
[7:3.5.20-13]
- Resolves: #1620546 - migration of upstream squid
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | squid | 7:3.5.20-15.el7 |
| Oracle Linux · 7 | squid-migration-script | 7:3.5.20-15.el7 |
| Oracle Linux · 7 | squid-sysvinit | 7:3.5.20-15.el7 |
Vulnerabilities 3
-
Unscored —
The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointe…
-
Unscored —CVE-2018-1000027 EPSS 13%
The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Derefere…
-
Unscored —CVE-2019-13345 EPSS 74%
The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.