CVEvulnerability

CVE-2019-18678

5.3 MEDIUM Published 2019-11-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-11-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-444

Description

An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.

Affected configurations

• squid-cache squid (>= 3.0 <= 3.5.28) • squid-cache squid (>= 4.0 <= 4.8) • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.04 • canonical ubuntu linux 19.10 • debian debian linux 8.0 • fedoraproject fedora 30 • fedoraproject fedora 31

Related

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References