Mageia alert MGASA-2020-0361 (squid)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2020-0361: Updated squid packages fix security vulnerabilities 
Date:
             
 
Fri, 4 Sep 2020 11:17:18 +0200
Message-ID:
             
 
<20200904091718.25DCA9F6EB@duvel.mageia.org>
MGASA-2020-0361 - Updated squid packages fix security vulnerabilities

Publication date: 04 Sep 2020
URL: https://advisories.mageia.org/MGASA-2020-0361.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-15810,
     CVE-2020-15811,
     CVE-2020-24606

Description:
An issue was discovered in Squid before 4.13. Due to incorrect data validation,
HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic.
This leads to cache poisoning. This allows any client, including browser
scripts, to bypass local security and poison the proxy cache and any downstream
caches with content from an arbitrary source. When configured for relaxed
header parsing (the default), Squid relays headers containing whitespace
characters to upstream servers. When this occurs as a prefix to a
Content-Length header, the frame length specified will be ignored by Squid
(allowing for a conflicting length to be used from another Content-Length
header) but relayed upstream (CVE-2020-15810).

An issue was discovered in Squid before 4.13. Due to incorrect data validation,
HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This
leads to cache poisoning. This allows any client, including browser scripts, to
bypass local security and poison the browser cache and any downstream caches
with content from an arbitrary source. Squid uses a string search instead of
parsing the Transfer-Encoding header to find chunked encoding. This allows an
attacker to hide a second request inside Transfer-Encoding: it is interpreted
by Squid as chunked and split out into a second request delivered upstream.
Squid will then deliver two distinct responses to the client, corrupting any
downstream caches (CVE-2020-15811).

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial
of Service by consuming all available CPU cycles during handling of a crafted
Cache Digest response message. This only occurs when cache_peer is used with
the cache digests feature. The problem exists because peerDigestHandleReply()
livelocking in peer_digest.cc mishandles EOF (CVE-2020-24606).

References:
- https://bugs.mageia.org/show_bug.cgi?id=27211
- https://github.com/squid-cache/squid/security/advisories/...
- https://github.com/squid-cache/squid/security/advisories/...
- https://github.com/squid-cache/squid/security/advisories/...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2...

SRPMS:
- 7/core/squid-4.13-1.mga7