Summary
[7:3.5.20-15.1]
- Resolves: #1828359 - CVE-2020-11945 squid: improper access restriction upon
Digest Authentication nonce replay could lead to remote code execution
- Resolves: #1828360 - CVE-2019-12519 squid: improper check for new member in
ESIExpression::Evaluate allows for stack buffer overflow
- Resolves: #1829772 - CVE-2019-12525 squid: parsing of header
Proxy-Authentication leads to memory corruption
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | squid | 7:3.5.20-15.el7_8.1 |
| Oracle Linux · 7 | squid-migration-script | 7:3.5.20-15.el7_8.1 |
| Oracle Linux · 7 | squid-sysvinit | 7:3.5.20-15.el7_8.1 |
Vulnerabilities 3
-
Unscored —
An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpres…
-
Unscored —CVE-2019-12525 EPSS 24%
An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authe…
-
Unscored —CVE-2020-11945 EPSS 27%
An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to ga…