Summary
It was discovered that Squid incorrectly handled certain SNMP packets. A
remote attacker could possibly use this issue to cause memory consumption,
leading to a denial of service. This issue only affected Ubuntu 16.04 LTS
and Ubuntu 18.04 LTS. (CVE-2018-19132)
It was discovered that Squid incorrectly handled the cachemgr.cgi web
module. A remote attacker could possibly use this issue to conduct
cross-site scripting (XSS) attacks. (CVE-2019-13345)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | squid3 | 3.5.12-1ubuntu7.7 |
| Ubuntu · 18.04 LTS 18.04:LTS | squid3 | 3.5.27-1ubuntu1.2 |
Vulnerabilities 2
-
Unscored —
Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
-
Unscored —CVE-2019-13345 EPSS 74%
The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.